X6000R
Monthly
OS command injection in the TOTOLINK X6000R wireless router (firmware 9.4.0cu.652_B20230116) allows remote attackers to execute arbitrary shell commands on the device by supplying a crafted file_name argument that is processed by the firmware_check routine behind the /cgi-bin/cstecgi.cgi endpoint. The vendor-derived CVSS 4.0 vector scores this 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems), and our independent assessment is consistent: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating low-complexity, unauthenticated remote exploitation with scope change and full device compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and real-world exposure is limited to units whose web management interface is reachable from the attacker's position - a WAN-exposed admin interface or an attacker already positioned on the LAN.
This vulnerability is an OS command injection flaw in the setLanCfg function of TOTOLINK X6000R routers running firmware versions 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826. An authenticated attacker with high privileges can execute arbitrary operating system commands by manipulating the Hostname parameter in /usr/sbin/shttpd, potentially leading to complete device compromise. The vulnerability was disclosed via VulDB submission with proof-of-concept information available through reference ID 352475, though no active exploitation (KEV listing) has been reported.
OS command injection in the TOTOLINK X6000R wireless router (firmware 9.4.0cu.652_B20230116) allows remote attackers to execute arbitrary shell commands on the device by supplying a crafted file_name argument that is processed by the firmware_check routine behind the /cgi-bin/cstecgi.cgi endpoint. The vendor-derived CVSS 4.0 vector scores this 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems), and our independent assessment is consistent: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating low-complexity, unauthenticated remote exploitation with scope change and full device compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and real-world exposure is limited to units whose web management interface is reachable from the attacker's position - a WAN-exposed admin interface or an attacker already positioned on the LAN.
This vulnerability is an OS command injection flaw in the setLanCfg function of TOTOLINK X6000R routers running firmware versions 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826. An authenticated attacker with high privileges can execute arbitrary operating system commands by manipulating the Hostname parameter in /usr/sbin/shttpd, potentially leading to complete device compromise. The vulnerability was disclosed via VulDB submission with proof-of-concept information available through reference ID 352475, though no active exploitation (KEV listing) has been reported.