CVE-2026-1723: TOTOLINK X6000R OS Command Injection
CVE-2026-1723 is an OS command injection weakness (CWE-78) in TOTOLINK X6000R firmware through V9.4.0cu.1498_B20250826. The record lists a CVSS 4.0 base score of 9.2 (critical) from Palo Alto Networks PSIRT, and the CVE is not listed in CISA KEV. The record contains no structured affected or fixed version data, so administrators should confirm exposure and available updates directly with the vendor.
Overview
CVE-2026-1723 is categorized as CWE-78 (OS Command Injection) and affects the TOTOLINK X6000R, with the description stating that the issue applies through V9.4.0cu.1498_B20250826. The weakness means that input handled by the device may be passed to an operating system command without adequate neutralization.
Impact
The record describes the issue as allowing OS command injection. The CVSS 4.0 vector listed in the record indicates a network attack vector, no required privileges, no required user interaction, and high impact on the vulnerable system's integrity and availability, with high impact on confidentiality, integrity and availability for subsequent systems. The base score of 9.2 is shown as critical severity.
Affected products and versions
The description identifies TOTOLINK X6000R firmware through V9.4.0cu.1498_B20250826. The record contains no structured list of affected version ranges and no fixed version. The absence of a fixed version in the record does not mean no fix exists; the vendor download page referenced by the record should be checked for newer firmware.
Exploitation status
The CVE is not listed in CISA KEV in this record. No confirmed exploitation appears in the sources consulted, and this analysis does not state that the flaw is being actively exploited.
Remediation and mitigation
- Identify all X6000R devices in the environment and compare their firmware with the version range in the description.
- Check the TOTOLINK download page referenced in the record for an updated firmware build and apply it following the vendor's instructions.
- If no update is available for a device, limit exposure by removing public access to management interfaces, restricting administrative access to trusted networks, and placing the device behind segmentation controls.
- Review whether remote administration features are needed and disable them where they are not.
Detection guidance
- Review device and network logs for unexpected administrative requests, unusual management traffic, or configuration changes.
- Watch for unexpected outbound connections originating from the router, which can indicate that the device is being misused.
- Verify firmware version and integrity against the vendor's published builds.
Limitations of the available information
The record provides no structured affected or fixed version data, no EPSS score, no SSVC data, and no exploitation details beyond the KEV status. The title was not provided in the source record. The source status is marked as Deferred, so details may change as the CVE record is updated.
Frequently asked questions
What type of vulnerability is CVE-2026-1723?
It is classified as CWE-78, OS Command Injection, which means input may be passed to an operating system command without proper neutralization.
Is CVE-2026-1723 known to be actively exploited?
The CVE is not listed in CISA KEV in this record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.