TOTOLINK X6000R: Three New Vulnerabilities Uncovered

Palo Alto Networks Unit 42 has disclosed three vulnerabilities in the TOTOLINK X6000R router firmware, version V9.4.0cu.1360_B20241207, released on 28 March 2025. The flaws comprise CVE-2025-52905, an argument injection that can cause a DoS, CVE-2025-52906, an unauthenticated command injection enabling remote code execution, and CVE-2025-52907, a security bypass that can allow arbitrary file writes and potentially remote code execution.

The issues affect the router’s web interface, which relies on the /cgi-bin/cstecgi.cgi endpoint and a topicurl parameter, and were described as unauthenticated in some attack scenarios. TOTOLINK collaborated with Unit 42 to address the vulnerabilities, releasing an updated firmware version (V9.4.0cu.1498_B20250826) and advising users to install the latest firmware to secure their devices.

Disclosure timelines show the flaws were reported on 13 June 2025, with a fixed build provided on 19 June 2025, CVEs assigned on 20 June 2025, the updated firmware made public on 25 June 2025, and the CVEs published on 23 September 2025. The article also notes protections available from Palo Alto Networks products and urges timely firmware updates as a mitigation.