The Totolink X5000R router firmware version 9.1.0u.6369_B20230113 contains a buffer overflow vulnerability in the sub_458E40 function of the /boafrm/formDdns component. This vulnerability is triggered by manipulating the submit-url argument, allowing remote attackers to cause a buffer overflow. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. Public exploit code has been disclosed, but no known exploitation in the wild has been confirmed. No official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code or cause a denial of service on affected Totolink X5000R devices. The high CVSS score reflects significant potential impact on device confidentiality, integrity, and availability. Since the vulnerability can be triggered remotely without authentication or user interaction, affected devices are at elevated risk if exposed to untrusted networks.

As of the current information, no official patch or remediation is available from the vendor. Users should monitor Totolink's official channels for security advisories and updates addressing this vulnerability. Until a fix is released, limiting exposure of the affected device to untrusted networks and disabling remote management features, if possible, may reduce risk. Avoid using the vulnerable firmware version and plan to upgrade once a vendor-provided patch is available.