TOTOLINK X6000R vulnerabilities

A vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The issue affects the firmware_check function in /cgi-bin/cstecgi.cgi of the UploadFirmwareFile Handler component. Manipulation of the file_name argument leads to OS command injection. The attack can be performed remotely.

OS Command Injection vulnerability in TOTOLINK X6000R. The issue affects versions up to V9.4.0cu.1498_B20250826. An attacker can exploit this vulnerability to execute arbitrary system commands.

OS command injection vulnerability in TOTOLINK X6000R allows an attacker to execute arbitrary system commands. Affects versions up to V9.4.0cu.1458_B20250708.

Improper input validation vulnerability in TOTOLINK X6000R allows flooding attacks. Affects versions up to V9.4.0cu.1360_B20241207.

In the TOTOLINK X6000R router running firmware version V9.4.0cu.1041_B20240224, the Uci_Set_Str function in the shttpd file is used without strict parameter filtering. An attacker can achieve arbitrary command execution by crafting a malicious payload.

A remote command execution (RCE) vulnerability was discovered in the TOTOLINK X6000R router running firmware version v9.4.0cu.852_B20230719, specifically in the /cgi-bin/cstecgi.cgi component. An attacker can send a crafted request to execute arbitrary commands on the device.