X6000R vulnerabilities

9 known vulnerabilities in X6000R from TOTOLINK. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 10.0 Critical severity

  X6000R: Improper Neutralization of Special Elements used in a Command

  CVE-2026-105484Oct 6, 2026TOTOLINKEPSS 2.13%

  A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name l

• 8.8 High severity

  X6000R: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-4611Mar 23, 2026TOTOLINKEPSS 3.16%

  A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attac

• 9.2 Critical severity

  X6000R: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-1723Jan 30, 2026TOTOLINK

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1498_B20250826.

• 9.8 Critical severity

  X6000R: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-11005Sep 25, 2025TOTOLINKEPSS 1.3%

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458_B20250708.

• 8.8 High severity

  Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File…

  CVE-2025-52907Sep 24, 2025TOTOLINK

  Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360_B20241207.

• 9.8 Critical severity

  X6000R: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-52906Sep 24, 2025TOTOLINKEPSS 14.7%

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1360_B20241207.

• 9.8 Critical severity

  X6000R: Improper Neutralization of Special Elements used in a Command

  CVE-2024-7907Aug 18, 2024TOTOLINKEPSS 6.24%

  A vulnerability, which was classified as critical, has been found in TOTOLINK X6000R 9.4.0cu.852_20230719. This issue affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument rtLogServer leads to command injection. T

• 8.8 High severity

  X6000R: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-2353Mar 10, 2024TOTOLINKEPSS 3.95%

  A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os

• 9.8 Critical severity

  X6000R AX3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-1781Feb 23, 2024TOTOLINKEPSS 14.8%

  A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation leads to command injection. The exp