TOTOLINK X6000R EUVD-2026-92908

Exploitation targets the UploadFirmwareFile handler's firmware_check routine reached via the /cgi-bin/cstecgi.cgi endpoint on TOTOLINK X6000R firmware 9.4.0cu.652_B20230116; the attacker must be able to reach this web management interface over the network and supply a malicious file_name argument containing shell metacharacters. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, though firmware-upload handlers on such routers are sometimes reachable only after login - if that holds here, exploitation is limited to authenticated or LAN-adjacent attackers. Real-world exposure is further limited to devices whose management interface is reachable from the attacker's position (e.g. WAN-exposed admin interface, or an attacker already on the LAN), and to the specific affected firmware build.

All severity signals point to maximum theoretical risk: the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with full high impact to confidentiality, integrity and availability on both the vulnerable and subsequent systems (score 10.0), consistent with CWE-78 OS command injection yielding device takeover. However, the supporting exploitation-likelihood signals are either absent or weak: no EPSS score is provided, the CVE is not listed in CISA KEV, and no POC flag is set in the input, so there is no public exploit identified at time of analysis. The E:X (Exploit Maturity: Not Defined) in the vector confirms exploitation status is undetermined rather than proven. This is sourced from a single reporter (VulDB) with no corroborating independent or vendor advisory. Net assessment: a genuinely critical-by-design flaw that warrants prompt patching on exposed devices, but the lack of KEV/EPSS/POC evidence means there is no confirmation of real-world mass exploitation yet - treat as high-priority-to-remediate, not as a confirmed active threat. Note also the firmware-upload handler context: such endpoints sometimes require prior authentication in practice, which would contradict the PR:N rating - verify the actual auth requirement with the vendor.

A remote attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the UploadFirmwareFile handler's firmware_check function, embedding shell metacharacters in the file_name argument. Because the value is passed into an OS command without sanitization, the injected commands execute on the router with the web service's privileges (typically root on these devices). No public exploit was identified at time of analysis, though the attack is straightforward given low complexity and no required privileges per the CVSS vector.