PT-2025-39450 · Totolink · Totolink X6000R

Published 2025-09-25 · Updated 2025-10-16 · CVE-2025-11005

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R versions through V9.4.0cu.1458 B20250708

Description A flaw exists in TOTOLINK X6000R that allows for OS Command Injection due to improper neutralization of special elements used in an OS command. This could allow an attacker to execute arbitrary commands on the system.

Recommendations Update TOTOLINK X6000R to a version later than V9.4.0cu.1458 B20250708.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-12687

CVE-2025-11005

Affected Products

Totolink X6000R

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11005 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11005 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12687 · Security Note
• https://t.me/CVEtracker/33375 · Telegram Post
• https://totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html · Note
• https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0005/PANW-2025-0005.md · Note
• https://t.me/cveNotify/138988 · Telegram Post
• https://totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html?__K=3719fcdec6cf6d938aef045eadfbf23661759152751_3377586 · Note
• https://twitter.com/CVEnew/status/1971312454551413184 · Twitter Post