Vulnerabilities

Filters

Reset all

2 selected

57 records

Sort

Vendor: TOTOLINK Component: X6000r Firmware Clear all filters

TI-2026-04014 CVE-2026-4611 · GHSA-56rf-g9gc-682p

TOTOLINK X6000R shttpd setLanCfg privilege escalation

MEDIUM 45

A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.03088 Published 2026-03-23 No fix listed CWE-77

TI-2025-43098 CVE-2025-70328 · GHSA-jqhg-j5gv-hpmr

TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in…

HIGH 73

TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02037 Published 2026-02-23 No fix listed CWE-94

TI-2025-10076 CVE-2025-11005 · GHSA-34jw-gf29-7x45

TOTOLINK X6000R Unauthenticated Command Injection Vulnerability

MEDIUM 49

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458_B20250708.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01298 Published 2025-09-25 No fix listed CWE-78

TI-2025-32943 CVE-2025-52907 · GHSA-4g85-q6g8-m8qc

TOTOLINK X6000R Security Bypass Vulnerability

LOW 36

Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360_B20241207.

CVSS 4.0HIGH 7.3 Network No auth User interaction EPSS 0.00854 Published 2025-09-24 No fix listed CWE-20

TI-2025-32942 CVE-2025-52906 · GHSA-9vw4-pmg2-63m3

TOTOLINK X6000R Command Injection Vulnerability

HIGH 79

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.1309 Published 2025-09-24 No fix listed CWE-78

TI-2025-32941 CVE-2025-52905 · GHSA-94qm-cr28-jgjr

TOTOLINK X6000R Argument Injection Vulnerability

MEDIUM 42

Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through V9.4.0cu.1360_B20241207.

CVSS 4.0HIGH 7.0 Network No auth User interaction EPSS 0.09123 Published 2025-09-23 No fix listed CWE-20

TI-2025-32470 CVE-2025-52053 · GHSA-h7c7-9fw4-gxj5

TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection…

HIGH 82

TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04619 Published 2025-09-15 No fix listed CWE-77

TI-2025-32520 CVE-2025-52284 · GHSA-6m6p-wp2f-xjqc

Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection…

MEDIUM 64

Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02215 Published 2025-07-29 No fix listed CWE-77

TI-2025-19040 CVE-2025-25524 · GHSA-7gx7-rqf8-p84p

Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to…

LOW 24

Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length verification, which is related to the addition of Wi-Fi filtering rules.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00177 Published 2025-02-11 No fix listed CWE-120

TI-2024-35278 CVE-2024-52723 · GHSA-mqx6-fm3x-25wm

In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function…

MEDIUM 45

In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0102 Published 2024-11-22 No fix listed CWE-78

TI-2024-07329 CVE-2024-7907 · GHSA-p29g-9w74-gc5m

TOTOLINK X6000R cstecgi.cgi setSyslogCfg command injection

MEDIUM 59

A vulnerability, which was classified as critical, has been found in TOTOLINK X6000R 9.4.0cu.852_20230719.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.06239 Published 2024-08-18 No fix listed CWE-77

TI-2024-02188 CVE-2024-2353 · GHSA-j7wf-mfp9-jf55

Totolink X6000R shttpd cstecgi.cgi setDiagnosisCfg os command injection

MEDIUM 47

A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03952 Published 2024-03-10 No fix listed CWE-78

TI-2024-01658 CVE-2024-1781 · GHSA-9pr5-r4v8-xqjf

Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection

HIGH 75

A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14809 Published 2024-02-23 No fix listed CWE-77

TI-2024-01544 CVE-2024-1661 · GHSA-v3xc-v2g4-h75g

Totolink X6000R shadow hard-coded credentials

MEDIUM 58

A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00316 Published 2024-02-20 No fix listed CWE-798

TI-2023-28500 CVE-2023-52040 · GHSA-vh9j-8vw4-5hp6

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run…

HIGH 82

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00852 Published 2024-01-24 No fix listed CWE-253

TI-2023-28499 CVE-2023-52039 · GHSA-7j77-3p87-xr63

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run…

HIGH 82

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0077 Published 2024-01-24 No fix listed CWE-77

TI-2023-28498 CVE-2023-52038 · GHSA-78p2-p949-pjvr

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run…

HIGH 82

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0077 Published 2024-01-24 No fix listed CWE-77

TI-2023-28502 CVE-2023-52042 · GHSA-9h6f-343x-p726

An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719…

HIGH 76

An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00949 Published 2024-01-16 No fix listed CWE-77

TI-2023-28501 CVE-2023-52041 · GHSA-m266-vjjw-ch44

An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run…

HIGH 82

An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0086 Published 2024-01-16 No fix listed

TI-2023-27639 CVE-2023-50651 · GHSA-mv97-cv2v-gqc7

TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command…

HIGH 81

TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02802 Published 2023-12-30 No fix listed CWE-78

TI-2023-26626 CVE-2023-48800 · GHSA-22wf-fg96-jprv

In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function…

MEDIUM 45

In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resultin…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0155 Published 2023-12-04 No fix listed CWE-78

TI-2023-26625 CVE-2023-48799 · GHSA-f4hf-g9qr-gg3p

TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution.

MEDIUM 45

TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01434 Published 2023-12-04 No fix listed

TI-2023-26627 CVE-2023-48801 · GHSA-gc2r-5q9g-j8gq

In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function…

HIGH 82

In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resultin…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01693 Published 2023-12-01 No fix listed CWE-77

TI-2023-23230 CVE-2023-43455 · GHSA-m73r-2fp3-47jw

An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a…

MEDIUM 45

An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01521 Published 2023-12-01 No fix listed CWE-77

TI-2023-23229 CVE-2023-43454 · GHSA-5795-893f-fhqm

An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a…

HIGH 82

An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of the switchOpMode component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01521 Published 2023-12-01 No fix listed CWE-77