PT-2026-5443 · Totolink · Totolink X6000R

Published 2026-01-30 · Updated 2026-01-30 · CVE-2026-1723

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R versions through V9.4.0cu.1498 B20250826

Description A flaw exists in TOTOLINK X6000R that allows for OS Command Injection due to improper neutralization of special elements used in OS commands. This allows attackers to execute arbitrary commands on the system. The vulnerability enables unauthenticated remote attackers to compromise the device.

Recommendations Update TOTOLINK X6000R to a version later than V9.4.0cu.1498 B20250826.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-1723

Affected Products

Totolink X6000R

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-1723 · Security Note
• https://twitter.com/CVEnew/status/2017348168841592982 · Twitter Post
• https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2026-0001/PANW-2026-0001.md · Note
• https://twitter.com/0dayPublishing/status/2017344915743649999 · Twitter Post
• https://totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html · Note
• https://twitter.com/VulmonFeeds/status/2017357278899241139 · Twitter Post