PT-2025-39196 · Totolink · Totolink X6000R

Published 2025-09-23 · Updated 2025-10-01 · CVE-2025-52905

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R versions through V9.4.0cu.1360 B20241207

Description An improper input validation issue exists in TOTOLINK X6000R, potentially allowing for flooding attacks. The issue affects the device due to insufficient validation of input data.

Recommendations Update TOTOLINK X6000R to a version later than V9.4.0cu.1360 B20241207.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-12685

CVE-2025-52905

Affected Products

Totolink X6000R

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-52905 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52905 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12685 · Security Note
• https://twitter.com/SecAideInfo/status/1971518748239507571 · Twitter Post
• https://totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html · Note
• https://reddit.com/r/SecOpsDaily/comments/1nv54fc/totolink_x6000r_three_new_vulnerabilities · Reddit Post
• https://t.me/CVEtracker/33180 · Telegram Post
• https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0001/PANW-2025-0001.md · Note
• https://twitter.com/CVEnew/status/1970621791531147273 · Twitter Post