CVE-2026-1723: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R:…

Critical severity · published Jan 30, 2026

CVE-2026-1723

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R:…

9.2

CVSS

1%

EPSS

No

On KEV

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1498_B20250826.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 63% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-1723

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-1723

github.com

https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2026-0001/PANW-2026-0001.md

www.totolink.net

https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html