Description
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.
Published: 2026-10-06
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A remote attacker can manipulate the 'file_name' parameter of the firmware_check function in /cgi-bin/cstecgi.cgi, causing an OS command injection that permits execution of arbitrary shell commands on the device, potentially leading to full control over the router and compromising confidentiality, integrity, and availability.

Affected Systems

TOTOLINK X6000R routers running firmware version 9.4.0cu.652_B20230116 are affected, and any similar model using the same upload firmware handler may also be vulnerable.

Risk and Exploitability

The vulnerability has a CVSS score of 10 with no EPSS data, and is not listed in the CISA KEV catalog; exploitation requires remote access to the device through the admin interface and can be achieved by sending a crafted request to the UploadFirmwareFile handler, making it highly likely to be abused if the appliance is exposed to the Internet.

Generated by OpenCVE AI on October 6, 2026 at 02:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the router to the latest firmware version that removes the vulnerable code in firmware_check.
  • If an immediate upgrade is not possible, block external access to /cgi-bin/cstecgi.cgi by configuring firewall rules or disabling the UploadFirmwareFile handler via router configuration.
  • Enable authentication and restrict administrative interfaces so that only trusted local users can invoke the firmware upload endpoint, and monitor for abnormal command execution attempts.

Generated by OpenCVE AI on October 6, 2026 at 02:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink x6000r
Vendors & Products Totolink x6000r

Tue, 06 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.
Title TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection
First Time appeared Totolink
Totolink x6000r Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:x6000r_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink x6000r Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X'}

Subscriptions

Totolink X6000r X6000r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-06T01:00:19.684Z

Reserved: 2026-10-05T15:01:47.713Z

Link: CVE-2026-105484

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T02:17:04.040

Modified: 2026-10-06T02:17:04.040

Link: CVE-2026-105484

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T02:30:18Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')