Read the docs
TI-2025-43098 Aliases CVE-2025-70328GHSA-jqhg-j5gv-hpmr

TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in…

Priority HIGH 73CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.

Summary

TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The host_time parameter is retrieved via sub_40C404 and passed to a date -s shell command through CsteSystem. While the first two tokens of the input are validated, the remainder of the string is not sanitized, allowing authenticated attackers to execute arbitrary shell commands via shell metacharacters.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02037 81st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:totolink:x6000r_firmware:9.4.0cu.1498_b20250826:*:*:*:*:*:*:*9.4.0cu.1498_b20250826VulnerableTOTOLINK
cpe:2.3:h:totolink:x6000r:-:*:*:*:*:*:*:*not specified by NVDRunning onTOTOLINK
  • cpe:2.3:o:totolink:x6000r_firmware:9.4.0cu.1498_b20250826:*:*:*:*:*:*:* Versions 9.4.0cu.1498_b20250826 Vulnerable ·TOTOLINK
  • cpe:2.3:h:totolink:x6000r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TOTOLINK

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-70328
  2. 2026-10-03 Alias added: GHSA-jqhg-j5gv-hpmr

References

Exploit 2

  • TI-2025-32470 TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection… CVSS 3.1CRITICAL 9.8
  • TI-2023-28501 An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run… CVSS 3.1CRITICAL 9.8
  • TI-2023-28500 An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run… CVSS 3.1CRITICAL 9.8
  • TI-2023-28499 An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run… CVSS 3.1CRITICAL 9.8
  • TI-2023-28498 An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run… CVSS 3.1CRITICAL 9.8
  • TI-2023-26637 In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains… CVSS 3.1CRITICAL 9.8
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences