All vulnerabilities
CVE-2026-105484

TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

TOTOLINK X6000RNetwork & edge
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)2.13%Chance of exploitation activity in the next 30 days, higher than 81% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published6 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.

Text from CVE List

Affected versions 1

  • X6000Raffected: 9.4.0cu.652_B20230116CVE List

References 5