CVE-2021-45736 Denial of service in n/a

What is CVE-2021-45736?

CVE-2021-45736 is a high-severity denial of service vulnerability in Totolink X5000r Firmware, published on 4 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setL2tpServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the eip, sip, server parameters.

Which versions are affected by CVE-2021-45736?

It affects 1 product.

Products include Totolink X5000r Firmware.

How do I fix CVE-2021-45736?

No fix has been published for CVE-2021-45736 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-45736 being exploited?

There is no known exploitation of CVE-2021-45736 in the wild and no public exploit code.

Other vulnerabilities in Totolink X5000r Firmware

• CVE-2025-70327 Command injection in n/a Critical 9.8
• CVE-2025-13184 Auth bypass in X5000R's (AX1800 router) Critical 9.8
• CVE-2024-42737 Command injection in n/a Critical 9.8
• CVE-2024-42745 Command injection in n/a Critical 9.8
• CVE-2024-42748 Command injection in n/a Critical 9.8

All Totolink X5000r Firmware vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c3p4-6x5w-74fx.