X2000R
13 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for X2000R, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.
X2000R CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 5 |
| 2025-07 | 1 |
| 2025-08 | 1 |
| 2025-09 | 1 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 13 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High4
- Medium5
- Low4
Latest CVEs
The 13 most recently published vulnerabilities affecting X2000R.
- CVE-2025-57579An issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote attacker to execute arbitrary code via the default password8.0
- CVE-2025-9577TOTOLINK X2000R Administrative shadow.sample default credentials2.5
- CVE-2025-8181TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violation7.2
- CVE-2025-5543TOTOLINK X2000R Parent Controls Page cross site scripting2.4
- CVE-2025-5542TOTOLINK X2000R Virtual Server Page formPortFw cross site scripting2.4
- CVE-2025-5516TOTOLINK X2000R URL Filtering Page formFilter cross site scripting2.4
- CVE-2025-5515TOTOLINK X2000R formMapDel command injection6.3
- CVE-2025-5504TOTOLINK X2000R formWsc command injection6.3
- CVE-2024-28403TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page.5.4
- CVE-2024-28404TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page.8.0
- CVE-2024-28401TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wireless Page.5.4
- CVE-2024-0579Totolink X2000R formMapDelDevice command injection6.3
- CVE-2023-7222Totolink X2000R HTTP POST Request boa formTmultiAP buffer overflow7.2
Product grouping is registry-driven, with AI assist and human review. How it works