CVE-2025-52906

published 2025-09-24

CVE-2025-52906: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This…

Priority P2 77 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1360_B20241207.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
totolink	x6000r	<= V9.4.0cu.1360_B20241207	—
totolink	x6000r_firmware	<= 9.4.0cu.1360_b20241207	—

Detection & IOCs extracted from sources · hover to see the quote

url /cgi-bin/cstecgi.cgi↗

other topicurl=setEasyMeshAgentCfg

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink setEasyMeshAgentCfg agentName Parameter Command Injection Attempt (CVE-2025-52906, CVE-2025-61044, CVE-2025-61045)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/cgi-bin/cstecgi.cgi"; http.request_body; content:"topicurl|3d|setEasyMeshAgentCfg"; fast_pattern; pcre:"/(?:mac|agent)\x3d[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/"; reference:url,github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0002/PANW-2025-0002.md; reference:cve,2025-52906; classtype:attempted-admin; sid:2064884; rev:2;)

• → Target the POST method to /cgi-bin/cstecgi.cgi with a request body containing topicurl=setEasyMeshAgentCfg; the agentName (or mac/agent) parameter will carry the injected payload using shell metacharacters: semicolon (;/%3B), newline (%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24).
• → The vulnerability is unauthenticated — no session cookie or credential check is required. Any HTTP client that can reach the router's web interface can trigger the injection via the setEasyMeshAgentCfg function. ↗
• → The /cgi-bin/cstecgi.cgi endpoint uses the topicurl parameter as a routing mechanism; monitor for POST requests to this endpoint with topicurl values referencing sensitive configuration functions (e.g., setEasyMeshAgentCfg, setWizardCfg). ↗
• → Affected firmware version is V9.4.0cu.1360_B20241207; use device fingerprinting to identify exposed TOTOLINK X6000R routers running this version and prioritize them for patching or network segmentation. ↗

• · The Snort/ET rule (sid:2064884) covers CVE-2025-52906 alongside CVE-2025-61044 and CVE-2025-61045; tune or scope accordingly if only CVE-2025-52906 detection is desired.
• · The URI content match uses an exact byte-size constraint (bsize:20) for /cgi-bin/cstecgi.cgi; ensure your IDS/IPS does not strip or normalize the URI before this match is evaluated.
• · The rule is marked tls_state plaintext — it will not detect exploitation over HTTPS/TLS without SSL inspection enabled on the monitoring device.

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78