PT-2025-39313 · Totolink · Totolink X6000R

Published 2025-09-24 · Updated 2025-10-01 · CVE-2025-52907

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R versions through V9.4.0cu.1360 B20241207

Description The software contains an improper input validation issue that can lead to command injection and file manipulation. The vulnerability exists due to insufficient validation of user-supplied input. This allows an attacker to inject arbitrary commands and manipulate files on the system. There is no information about the number of potentially affected devices or any real-world incidents where this issue was exploited.

Recommendations Update TOTOLINK X6000R to a version later than V9.4.0cu.1360 B20241207.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-12684

CVE-2025-52907

Affected Products

Totolink X6000R

References · 8

• https://bdu.fstec.ru/vul/2025-12684 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52907 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52907 · Security Note
• https://totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html · Note
• https://reddit.com/r/SecOpsDaily/comments/1nv54fc/totolink_x6000r_three_new_vulnerabilities · Reddit Post
• https://t.me/CVEtracker/33272 · Telegram Post
• https://twitter.com/CVEnew/status/1970996078024720876 · Twitter Post
• https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0003/PANW-2025-0003.md · Note