PT-2025-39310 · Totolink · Totolink X6000R

Published 2025-09-24 · Updated 2025-11-08 · CVE-2025-52906

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R versions through V9.4.0cu.1360 B20241207

Description A flaw exists in TOTOLINK X6000R that allows for OS Command Injection. This occurs due to improper neutralization of special elements used in an OS command. An attacker could potentially execute malicious commands on the system.

Recommendations Update TOTOLINK X6000R to a version later than V9.4.0cu.1360 B20241207.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-52906

Affected Products

Totolink X6000R

References · 13

• https://osv.dev/vulnerability/CVE-2025-52906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52906 · Security Note
• https://twitter.com/SecAideInfo/status/1971880765467042225 · Twitter Post
• https://totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html · Note
• https://reddit.com/r/SecOpsDaily/comments/1nv54fc/totolink_x6000r_three_new_vulnerabilities · Reddit Post
• https://t.me/CVEtracker/33271 · Telegram Post
• https://twitter.com/CveFindCom/status/1970913666372342167 · Twitter Post
• https://twitter.com/PurpleOps_io/status/1973614053034471777 · Twitter Post
• https://t.me/pentestingnews/69001 · Telegram Post
• https://twitter.com/Komodosec/status/1986991957999239359 · Twitter Post
• https://twitter.com/flamepycrack_/status/1973810508240457895 · Twitter Post
• https://twitter.com/CVEnew/status/1970996079899582771 · Twitter Post
• https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0002/PANW-2025-0002.md · Note