Is CVE-2025-70329 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2025-70329, but active exploitation has not been confirmed.

Can CVE-2025-70329 be exploited remotely?

Partially. CVE-2025-70329 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2025-70329?

CVE-2025-70329 has a CVSS score of 8.0 (HIGH) and an EPSS exploitation probability of 0.49%.

HOME VULNERABILITIESCVE-2025-70329

HIGHPOC

CVE-2025-70329

CWE-78Published: February 23, 2026· Updated: Feb 24, 2026

8.0

CVSS v3.1

EPSS:0.49%probability of exploitation in 30 daysPercentile:64.9th

Official Description

TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlanVidLan1 (and other vlanVidLanX) parameters are retrieved via Uci_Get_Str and passed to the CsteSystem function without adequate validation or filtering. This allows an authenticated attacker to execute arbitrary shell commands with root privileges by injecting shell metacharacters into the affected parameters.

NVD Source

Technical Analysis

CVE-2025-70329 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.0.

A proof-of-concept (PoC) exploit exists for CVE-2025-70329. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.