X6000r Firmware (Totolink) - vulnerabilities (CVEs)

58 CVEs, 1 in the last 30 days, 6 known versions, newest CVE from 2026-10-06. Vendor: Totolink.

CVEs of X6000r Firmware

CVE-2026-105484 - CVSS 10 (critical), 2026-10-06: A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file…
CVE-2026-4611 - CVSS 8.8 (high), 2026-03-23: A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file…
CVE-2025-70328 - CVSS 8.8 (high), 2026-02-23: TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The…
CVE-2025-11005 - CVSS 9.8 (critical), 2025-09-25: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This…
CVE-2025-52907 - CVSS 8.8 (high), 2025-09-24: Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through…
CVE-2025-52906 - CVSS 9.8 (critical), 2025-09-24: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This…
CVE-2025-52905 - CVSS 7.5 (high), 2025-09-23: Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through V9.4.0cu.1360_B20241207.
CVE-2025-52053 - CVSS 9.8 (critical), 2025-09-15: TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This…
CVE-2025-52284 - CVSS 6.5 (medium), 2025-07-29: Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This…
CVE-2025-25524 - CVSS 5.1 (medium), 2025-02-11: Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length verification, which is related to the addition of…
CVE-2024-52723 - CVSS 9.8 (critical), 2024-11-22: In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve…
CVE-2024-7907 - CVSS 9.8 (critical), 2024-08-18: A vulnerability, which was classified as critical, has been found in TOTOLINK X6000R 9.4.0cu.852_20230719. This issue affects the function setSyslogCfg of the…
CVE-2024-2353 - CVSS 8.8 (high), 2024-03-10: A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of…
CVE-2024-1781 - CVSS 9.8 (critical), 2024-02-23: A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the…
CVE-2024-1661 - CVSS 5.5 (medium), 2024-02-20: A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of…
CVE-2023-52039 - CVSS 9.8 (critical), 2024-01-24: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.
CVE-2023-52038 - CVSS 9.8 (critical), 2024-01-24: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.
CVE-2023-52040 - CVSS 9.8 (critical), 2024-01-24: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.
CVE-2023-52042 - CVSS 9.8 (critical), 2024-01-16: An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter.
CVE-2023-52041 - CVSS 9.8 (critical), 2024-01-16: An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program.
CVE-2023-50651 - CVSS 9.8 (critical), 2023-12-30: TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.
CVE-2023-48800 - CVSS 9.8 (critical), 2023-12-04: In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf…
CVE-2023-48799 - CVSS 9.8 (critical), 2023-12-04: TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution.
CVE-2023-48801 - CVSS 9.8 (critical), 2023-12-01: In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf…
CVE-2023-43453 - CVSS 9.8 (critical), 2023-12-01: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the…
CVE-2023-43455 - CVSS 9.8 (critical), 2023-12-01: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of…
CVE-2023-43454 - CVSS 9.8 (critical), 2023-12-01: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of…
CVE-2023-48810 - CVSS 9.8 (critical), 2023-11-30: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when…
CVE-2023-48808 - CVSS 9.8 (critical), 2023-11-30: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when…
CVE-2023-48812 - CVSS 9.8 (critical), 2023-11-30: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when…
CVE-2023-48811 - CVSS 9.8 (critical), 2023-11-30: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when…
CVE-2023-48806 - CVSS 9.8 (critical), 2023-11-30: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when…
CVE-2023-48802 - CVSS 9.8 (critical), 2023-11-30: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when…
CVE-2023-48805 - CVSS 9.8 (critical), 2023-11-30: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when…
CVE-2023-48804 - CVSS 9.8 (critical), 2023-11-30: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when…
CVE-2023-48807 - CVSS 9.8 (critical), 2023-11-30: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when…
CVE-2023-48803 - CVSS 9.8 (critical), 2023-11-30: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when…
CVE-2023-46485 - CVSS 9.8 (critical), 2023-10-31: An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi…
CVE-2023-46484 - CVSS 9.8 (critical), 2023-10-31: An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.
CVE-2023-46979 - CVSS 9.8 (critical), 2023-10-31: TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function.
CVE-2023-46978 - CVSS 7.5 (high), 2023-10-31: TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication.
CVE-2023-46417 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function.
CVE-2023-46420 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function.
CVE-2023-46423 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function.
CVE-2023-46410 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function.
CVE-2023-46413 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function.
CVE-2023-46416 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function.
CVE-2023-46419 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function.
CVE-2023-46422 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function.
CVE-2023-46409 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function.
CVE-2023-46412 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function.
CVE-2023-46415 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.
CVE-2023-46418 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function.
CVE-2023-46421 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function.
CVE-2023-46424 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function.
CVE-2023-46408 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function.
CVE-2023-46411 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function.
CVE-2023-46414 - CVSS 9.8 (critical), 2023-10-25: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function.