Totolink X6000R vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Totolink X6000R: 5 record(s), with affected versions and fixes.
CVE-2026-105484
Critical · 10.0
CWE-77 Oct 5, 2026
TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.
CVE-2026-4611
High · 8.8
CWE-78 Mar 23, 2026
TOTOLINK X6000R shttpd setLanCfg privilege escalation
A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attack may be launched remotely.
CVE-2026-1723
Critical · 9.2
CWE-78 Jan 30, 2026
TOTOLINK X6000R OS Command Injection (CVE-2026-1723)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1498_B20250826.
CVE-2025-11005
Critical · 9.8
CWE-78 Sep 25, 2025
TOTOLINK X6000R Unauthenticated Command Injection Vulnerability
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458_B20250708.
CVE-2025-52905
High · 7.5
CWE-20 Sep 23, 2025
TOTOLINK X6000R Argument Injection Vulnerability
Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through V9.4.0cu.1360_B20241207.