CVE-2023-50651
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
A remote command execution (RCE) vulnerability was discovered in the TOTOLINK X6000R router running firmware version v9.4.0cu.852_B20230719, specifically in the /cgi-bin/cstecgi.cgi component. An attacker can send a crafted request to execute arbitrary commands on the device.
Risk Assessment
The risk for the organization is that an unauthorized attacker could gain full control over the router, potentially compromising network confidentiality and integrity.
Recommendation
It is recommended to immediately update the TOTOLINK X6000R firmware to the latest version that fixes this vulnerability. If an update is not available, restrict management interface access to trusted networks only.
Other vulnerabilities in TOTOLINK X6000R
See all- CVE-2026-1723Critical
OS Command Injection vulnerability in TOTOLINK X6000R. The issue affects versions up to V9.4.0cu.1498_B20250826. An attacker can exploit this vulnerability to execute arbitrary system commands.
- CVE-2024-52723Critical
In the TOTOLINK X6000R router running firmware version V9.4.0cu.1041_B20240224, the Uci_Set_Str function in the shttpd file is used without strict parameter filtering. An attacker can achieve arbitrary command execution by crafting a malicious payload.
Original NVD description (English source)
TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.