TOTOLINK X6000R Routers Hit by Three Vulnerabilities Allowing Remote Code Execution
## Security Vulnerabilities in TOTOLINK X6000R Router
Security Vulnerabilities in TOTOLINK X6000R Router
Three critical security vulnerabilities have been identified in firmware version V9.4.0cu.1360_B20241207 of the TOTOLINK X6000R router, released on Thu, Mar 28, 2025.
These vulnerabilities include argument injection, command injection, and a security bypass, potentially leading to remote code execution.
Attackers may exploit these vulnerabilities to crash devices, corrupt system files, and execute arbitrary commands without authentication.
Users are advised to promptly update to the patched firmware version V9.4.0cu.1498_B20250826 to secure their networks.
CVE Identifier Rating CVSS-B Score Description
These vulnerabilities include argument injection, command injection, and a security bypass, potentially leading to remote code execution.
CVE-2025-52905 High 7.0 Argument injection flaw that can crash the router or overwhelm external servers, resulting in denial of service.
CVE-2025-52906 Critical 9.3 Unauthenticated command injection allowing remote execution of arbitrary commands on the device.
CVE-2025-52907 High 7.3 Security bypass enabling arbitrary file writes, persistent denial-of-service, or chainable remote code execution exploits.
Technical Analysis of Argument Injection - CVE-2025-52905
The central web interface endpoint, /cgi-bin/cstecgi.cgi , processes user inputs based on a topicurl parameter. CVE-2025-52905 arises from an incomplete input validation function that fails to block the hyphen (–), allowing malicious payloads to bypass filtering. Exploitation requires network access to the router’s web UI.
Unauthenticated Command Injection Impact - CVE-2025-52906
CVE-2025-52906 is located in the setEasyMeshAgentCfg function, which does not properly sanitize the agentName parameter. Unauthenticated attackers can insert shell commands, which are executed with elevated privileges, potentially installing persistent malware or intercepting network traffic.
Security Bypass Leading to RCE - CVE-2025-52907
CVE-2025-52907 involves the setWizardCfg function, which allows attackers to perform arbitrary file writes. Critical system files can be modified, enabling remote code execution on restart. This vulnerability underscores the importance of robust input validation in IoT firmware.
Users of the TOTOLINK X6000R are strongly advised to update to firmware V9.4.0cu.1498_B20250826 immediately. Maintaining up-to-date firmware and network monitoring is essential to protect against emerging IoT threats.
Based on reporting by GBHackers.