CVE-2026-105484
CriticalCVSS 10.0Summary
A vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The issue affects the firmware_check function in /cgi-bin/cstecgi.cgi of the UploadFirmwareFile Handler component. Manipulation of the file_name argument leads to OS command injection. The attack can be performed remotely.
Risk Assessment
A remote attacker can execute arbitrary system commands on the device, potentially leading to full compromise of the router and control over the network.
Recommendation
Immediately update the router firmware to the latest available version if a patch is provided. Otherwise, restrict access to the admin panel and CGI interface to trusted networks only.
Other vulnerabilities in TOTOLINK X6000R
See all- CVE-2026-1723Critical
OS Command Injection vulnerability in TOTOLINK X6000R. The issue affects versions up to V9.4.0cu.1498_B20250826. An attacker can exploit this vulnerability to execute arbitrary system commands.
- CVE-2024-52723Critical
In the TOTOLINK X6000R router running firmware version V9.4.0cu.1041_B20240224, the Uci_Set_Str function in the shttpd file is used without strict parameter filtering. An attacker can achieve arbitrary command execution by crafting a malicious payload.
- CVE-2023-50651Critical
A remote command execution (RCE) vulnerability was discovered in the TOTOLINK X6000R router running firmware version v9.4.0cu.852_B20230719, specifically in the /cgi-bin/cstecgi.cgi component. An attacker can send a crafted request to execute arbitrary commands on the device.
Original NVD description (English source)
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS