Critical Flaw CVE-2025-52906 (CVSS 9.3) Allows Unauthenticated RCE on TOTOLINK X6000R Routers

According to Unit 42, Palo Alto Networks’ threat intelligence team, three flaws were disclosed in the TOTOLINK X6000R router firmware, with CVE-2025-52906 described as the most severe and rated Critical (CVSS 9.3). The vulnerability lies in the setEasyMeshAgentCfg function, which fails to validate the agentName parameter, and unlocks unauthenticated remote command execution when an attacker can reach the router’s web interface.

If exploited, attackers could execute arbitrary commands with root privileges, enabling them to intercept network traffic, pivot to other devices on the same network, or install persistent malware. The report notes that this flaw does not require authentication. TOTOLINK has issued a fix, advising users to upgrade their X6000R routers to firmware V9.4.0cu.1498_B20250826 to secure affected devices.

The disclosure also covers CVE-2025-52905 and CVE-2025-52907, both high-severity flaws in the same firmware, underscoring the widespread impact of these vulnerabilities. The article is dated 2 October 2025.