Login Request a demo
X6
Product
X6000R
by TOTOLINK · last CVE Oct 6, 2026
58
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Vulnerabilities58In the news0Timeline
Severity mix
Critical 49High 6Medium 3Low 0
Severity
All severities58Critical49High6Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add X6000R to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-105484
10.0
2%
Oct 6
TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection
Affected: 9.4.0cu.652_B20230116
CVE-2025-11005
9.8
1%
Sep 25
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R:…
Affected: through 9.4.0cu.1360_b20241207
CVE-2025-52906
9.8
13%
Sep 24
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R:…
Affected: through 9.4.0cu.1360_b20241207
CVE-2025-52053
9.8
4%
Sep 15
TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter
Affected: 9.4.0cu.1360_b20241207
CVE-2024-52723
9.8
1%
Nov 22
In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering
Affected: 9.4.0cu.1041_b20240224
CVE-2024-7907
9.8
6%
Aug 18
A vulnerability, which was classified as critical, has been found in TOTOLINK X6000R 9.4.0cu.852_20230719
Affected: 9.4.0cu.852_b20230719
CVE-2024-1781
9.8
15%
Feb 23
A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719
Affected: 9.4.0cu.852_b20230719
CVE-2023-52040
9.8
1%
Jan 24
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function
Affected: 9.4.0cu.852_b20230719
CVE-2023-52039
9.8
1%
Jan 24
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function
Affected: 9.4.0cu.852_b20230719
CVE-2023-52038
9.8
1%
Jan 24
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function
Affected: 9.4.0cu.852_b20230719
CVE-2023-52042
9.8
1%
Jan 16
An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter
Affected: 9.4.0cu.852_b20230719
CVE-2023-52041
9.8
1%
Jan 16
An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program
Affected: 9.4.0cu.852_b20230719
CVE-2023-50651
9.8
3%
Dec 30
TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi
Affected: 9.4.0cu.852_b20230719
CVE-2023-48800
9.8
2%
Dec 4
In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes…
Affected: 9.4.0cu.852_b20230719
CVE-2023-48799
9.8
1%
Dec 4
TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution
Affected: 9.4.0cu.852_b20230719
CVE-2023-48801
9.8
2%
Dec 1
In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf function, and passes…
Affected: 9.4.0cu.852_b20230719
CVE-2023-43455
9.8
2%
Dec 1
An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the…
Affected: 9.4.0cu.652_b20230116; 9.4.0cu.852_b20230719
CVE-2023-43454
9.8
2%
Dec 1
An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of the switchOpMode…
Affected: 9.4.0cu.652_b20230116; 9.4.0cu.852_b20230719
CVE-2023-43453
9.8
2%
Dec 1
An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the setDiagnosisCfg…
Affected: 9.4.0cu.652_b20230116; 9.4.0cu.852_b20230719
CVE-2023-48812
9.8
2%
Nov 30
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the…
Affected: 9.4.0cu.852_b20230719
CVE-2023-48811
9.8
2%
Nov 30
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the…
Affected: 9.4.0cu.852_b20230719
CVE-2023-48810
9.8
2%
Nov 30
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem…
Affected: 9.4.0cu.852_b20230719
CVE-2023-48808
9.8
2%
Nov 30
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem…
Affected: 9.4.0cu.852_b20230719
CVE-2023-48807
9.8
2%
Nov 30
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem…
Affected: 9.4.0cu.852_b20230719
CVE-2023-48806
9.8
2%
Nov 30
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem…
Affected: 9.4.0cu.852_b20230719
CVE-2023-48805
9.8
2%
Nov 30
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem…
Affected: 9.4.0cu.852_b20230719
CVE-2023-48804
9.8
2%
Nov 30
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem…
Affected: 9.4.0cu.852_b20230719
CVE-2023-48803
9.8
2%
Nov 30
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem…
Affected: 9.4.0cu.852_b20230719
CVE-2023-48802
9.8
2%
Nov 30
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem…
Affected: 9.4.0cu.852_b20230719
CVE-2023-46485
9.8
1%
Oct 31
An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi component
Affected: 9.4.0cu.852_b20230719
CVE-2023-46484
9.8
1%
Oct 31
An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function
Affected: 9.4.0cu.852_b20230719
CVE-2023-46979
9.8
2%
Oct 31
TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function
Affected: 9.4.0cu.852_b20230719
CVE-2023-46424
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46423
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46422
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46421
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46420
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46419
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46418
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46417
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46416
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46415
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46414
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46413
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46412
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46411
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46410
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46409
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function
Affected: 9.4.0cu.652_b20230116
CVE-2023-46408
9.8
2%
Oct 25
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function
Affected: 9.4.0cu.652_b20230116
CVE-2026-4611
8.8
3%
Mar 23
TOTOLINK X6000R shttpd setLanCfg privilege escalation
Affected: 9.4.0cu.1360_B20241207; 9.4.0cu.1498_B20250826
Page 1 of 2 · 58 total
12