The setLanCfg function within the shttpd daemon on certain TOTOLINK X6000R routers allows a crafted Hostname argument to trigger operating‑system command injection. By exploiting this flaw an attacker can run arbitrary commands with the privileges of the shttpd process, effectively gaining privileged control over the device. The vulnerability is related to Command injection weaknesses (CWE‑77) and Shell Command injection (CWE‑78).

Devices running the TOTOLINK X6000R firmware versions 9.4.0cu.1360_B20241207 or 9.4.0cu.1498_B20250826 are vulnerable. The affected product is the X6000R router model, accessible via its web management interface.

The flaw can be triggered remotely through the exposed HTTP service; based on the description, it is inferred that no prior authentication or local access is required beyond network connectivity to the router. Its rating indicates high severity, and the EPSS score of 3% suggests a moderate likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, yet an attacker who succeeds could fully compromise the device, allowing unauthorized configuration changes, data exfiltration, and persistence within the network.