X6000r Firmware

CVEs (57)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2025-52906	Totolink X6000R	Cri	0.65	9.8	0.13	Sep 24, 2025	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1360_B20241207.
CVE-2025-11005	Totolink X6000R	Cri	0.64	9.8	0.01	Sep 25, 2025	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458_B20250708.
CVE-2025-52053	Totolink X6000R	Cri	0.64	9.8	0.04	Sep 15, 2025	TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.
CVE-2024-52723	Totolink X6000R	Cri	0.64	9.8	0.01	Nov 22, 2024	In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.
CVE-2023-52040	Totolink X6000R	Cri	0.64	9.8	0.01	Jan 24, 2024	An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.
CVE-2023-52039	Totolink X6000R	Cri	0.64	9.8	0.01	Jan 24, 2024	An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.
CVE-2023-52038	Totolink X6000R	Cri	0.64	9.8	0.01	Jan 24, 2024	An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.
CVE-2023-52042	Totolink X6000R	Cri	0.64	9.8	0.01	Jan 16, 2024	An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter.
CVE-2023-52041	Totolink X6000R	Cri	0.64	9.8	0.01	Jan 16, 2024	An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program.
CVE-2023-50651	Totolink X6000R	Cri	0.64	9.8	0.03	Dec 30, 2023	TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.
CVE-2023-48800	Totolink X6000R	Cri	0.64	9.8	0.02	Dec 4, 2023	In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
CVE-2023-48799	Totolink X6000r Firmware	Cri	0.64	9.8	0.01	Dec 4, 2023	TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution.
CVE-2023-48801	Totolink X6000R	Cri	0.64	9.8	0.02	Dec 1, 2023	In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
CVE-2023-43455	Totolink X6000R	Cri	0.64	9.8	0.02	Dec 1, 2023	An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component.
CVE-2023-43454	Totolink X6000R	Cri	0.64	9.8	0.02	Dec 1, 2023	An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of the switchOpMode component.
CVE-2023-43453	Totolink X6000R	Cri	0.64	9.8	0.02	Dec 1, 2023	An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the setDiagnosisCfg component.
CVE-2023-48812	Totolink X6000R	Cri	0.64	9.8	0.02	Nov 30, 2023	In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability.
CVE-2023-48811	Totolink X6000R	Cri	0.64	9.8	0.02	Nov 30, 2023	In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability.
CVE-2023-48810	Totolink X6000R	Cri	0.64	9.8	0.02	Nov 30, 2023	In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVE-2023-48808	Totolink X6000R	Cri	0.64	9.8	0.02	Nov 30, 2023	In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.

CVE-2025-52906CriSep 24, 2025
Totolink
X6000R
risk 0.65cvss 9.8epss 0.13
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1360_B20241207.
CVE-2025-11005CriSep 25, 2025
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458_B20250708.
CVE-2025-52053CriSep 15, 2025
Totolink
X6000R
risk 0.64cvss 9.8epss 0.04
TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.
CVE-2024-52723CriNov 22, 2024
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.
CVE-2023-52040CriJan 24, 2024
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.
CVE-2023-52039CriJan 24, 2024
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.
CVE-2023-52038CriJan 24, 2024
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.
CVE-2023-52042CriJan 16, 2024
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter.
CVE-2023-52041CriJan 16, 2024
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program.
CVE-2023-50651CriDec 30, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.03
TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.
CVE-2023-48800CriDec 4, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
CVE-2023-48799CriDec 4, 2023
Totolink
X6000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution.
CVE-2023-48801CriDec 1, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
CVE-2023-43455CriDec 1, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component.
CVE-2023-43454CriDec 1, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of the switchOpMode component.
CVE-2023-43453CriDec 1, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the setDiagnosisCfg component.
CVE-2023-48812CriNov 30, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability.
CVE-2023-48811CriNov 30, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability.
CVE-2023-48810CriNov 30, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVE-2023-48808CriNov 30, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.

Page 1 of 3