Vulnerability · Published Oct 6, 2026 · Assigned by VulDB

CVE-2026-105484TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

Critical 10.0

In plain English

A critical-severity OS command injection in X6000R from TOTOLINK. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)2.1%top 18.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.

Affected products (as reported)

Vendor	Product	Versions
TOTOLINK	X6000R	9.4.0cu.652_B20230116

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R

References

VDB-413619 | TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection vdb-entry, technical-description
VDB-413619 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-105484 | CVE Analysis and Report third-party-advisory
Submit #984434 | TOTOLINK X6000R 9.4.0cu.652_B20230116 CWE-78 OS Command Injection third-party-advisory
https://www.totolink.net/ broken-link, product