TOTOLINK X6000R Routers Hit by Three Vulnerabilities Allowing Remote Code Execution

Three critical vulnerabilities were discovered in firmware version V9.4.0cu.1360_B20241207 of the TOTOLINK X6000R router, which was released on 28 March 2025. The flaws span argument injection (CVE-2025-52905), unauthenticated command injection enabling remote code execution (CVE-2025-52906), and a security bypass that can lead to arbitrary file writes and chainable remote code execution (CVE-2025-52907).

According to Palo Alto Networks’ report, these issues allow attackers to crash devices, corrupt system files, or execute arbitrary commands without authentication, with exploitation feasible via the router’s web UI over the network. The article notes that a fixed firmware release, V9.4.0cu.1498_B20250826, has been issued and users should update immediately to protect their networks.

It also explains that CVSS scores range up to 9.3 for the unauthenticated command injection, and that the central web interface endpoint /cgi-bin/cstecgi.cgi processes input, with the sanitisation gaps enabling the exploits. Maintaining up-to-date firmware and monitoring remains essential to safeguarding IoT devices on home networks.