PT-2026-106300 · Totolink · X6000R

Liumingjie

·

CVE-2026-105484

·

Published

2026-10-06

·

Updated

2026-10-06

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652 B20230116. The impacted element is the function firmware check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file name leads to os command injection. The attack may be performed from remote.

Fix

OS Command Injection

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

CVE-2026-105484

Affected Products

X6000R