CVE-2025-52053
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.
Risk Assessment
An unauthenticated attacker can take control of the network device, potentially leading to full network compromise. The risk is high because no authentication is required.
Recommendation
Update TOTOLINK X6000R firmware to the latest version if the vendor provides a fix. Until then, restrict access to the device management interface.
Other vulnerabilities in TOTOLINK X6000R
See all- CVE-2026-105484Critical
A vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The issue affects the firmware_check function in /cgi-bin/cstecgi.cgi of the UploadFirmwareFile Handler component. Manipulation of the file_name argument leads to OS command injection. The attack can be performed remotely.
- CVE-2026-1723Critical
OS Command Injection vulnerability in TOTOLINK X6000R. The issue affects versions up to V9.4.0cu.1498_B20250826. An attacker can exploit this vulnerability to execute arbitrary system commands.
- CVE-2025-11005Critical
OS command injection vulnerability in TOTOLINK X6000R allows an attacker to execute arbitrary system commands. Affects versions up to V9.4.0cu.1458_B20250708.
- CVE-2025-52905High
Improper input validation vulnerability in TOTOLINK X6000R allows flooding attacks. Affects versions up to V9.4.0cu.1360_B20241207.
- CVE-2024-52723Critical
In the TOTOLINK X6000R router running firmware version V9.4.0cu.1041_B20240224, the Uci_Set_Str function in the shttpd file is used without strict parameter filtering. An attacker can achieve arbitrary command execution by crafting a malicious payload.
- CVE-2023-50651Critical
A remote command execution (RCE) vulnerability was discovered in the TOTOLINK X6000R router running firmware version v9.4.0cu.852_B20230719, specifically in the /cgi-bin/cstecgi.cgi component. An attacker can send a crafted request to execute arbitrary commands on the device.
Original NVD description (English source)
TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS