Totolink X6000R Firmware vulnerabilities
57 known vulnerabilities affecting totolink/x6000r_firmware.
Total CVEs
57
CISA KEV
0
Public exploits
1
Exploited in wild
2
Severity breakdown
CRITICAL48HIGH6MEDIUM3
Vulnerabilities
Page 3 of 3
CVE-2023-46409P3CRITICALCVSS 9.8v9.4.0cu.652_b202301162023-10-25
CVE-2023-46409 [CRITICAL] CWE-77 CVE-2023-46409: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability v
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function.
nvd
CVE-2023-46410P3CRITICALCVSS 9.8v9.4.0cu.652_b202301162023-10-25
CVE-2023-46410 [CRITICAL] CWE-77 CVE-2023-46410: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability v
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function.
nvd
CVE-2023-46411P3CRITICALCVSS 9.8v9.4.0cu.652_b202301162023-10-25
CVE-2023-46411 [CRITICAL] CWE-77 CVE-2023-46411: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability v
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function.
nvd
CVE-2023-46408P3CRITICALCVSS 9.8v9.4.0cu.652_b202301162023-10-25
CVE-2023-46408 [CRITICAL] CWE-77 CVE-2023-46408: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability v
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function.
nvd
CVE-2023-46413P3CRITICALCVSS 9.8v9.4.0cu.652_b202301162023-10-25
CVE-2023-46413 [CRITICAL] CWE-77 CVE-2023-46413: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability v
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function.
nvd
CVE-2023-46412P3CRITICALCVSS 9.8v9.4.0cu.652_b202301162023-10-25
CVE-2023-46412 [CRITICAL] CWE-77 CVE-2023-46412: TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability v
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function.
nvd
CVE-2023-52039P3CRITICALCVSS 9.8v9.4.0cu.852_b202307192024-01-24
CVE-2023-52039 [CRITICAL] CWE-77 CVE-2023-52039: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary comm
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.
nvd
CVE-2023-52038P3CRITICALCVSS 9.8v9.4.0cu.852_b202307192024-01-24
CVE-2023-52038 [CRITICAL] CWE-77 CVE-2023-52038: An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary comm
An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.
nvd
CVE-2023-46485P3CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-10-31
CVE-2023-46485 [CRITICAL] CWE-77 CVE-2023-46485: An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary cod
An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi component.
nvd
CVE-2023-46484P3CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-10-31
CVE-2023-46484 [CRITICAL] CWE-77 CVE-2023-46484: An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary cod
An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.
nvd
CVE-2025-52284P3MEDIUMCVSS 6.5v9.4.0cu.1360_b202412072025-07-29
CVE-2025-52284 [MEDIUM] CWE-77 CVE-2025-52284: Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in th
Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.
nvd
CVE-2025-52905P3HIGHCVSS 7.5≤ 9.4.0cu.1360_b202412072025-09-23
CVE-2025-52905 [HIGH] CWE-20 CVE-2025-52905: Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R
Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through V9.4.0cu.1360_B20241207.
nvd
CVE-2025-52907P3HIGHCVSS 8.8≤ 9.4.0cu.1360_b202412072025-09-24
CVE-2025-52907 [HIGH] CWE-20 CVE-2025-52907: Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulati
Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360_B20241207.
nvd
CVE-2023-52041P3CRITICALCVSS 9.8v9.4.0cu.852_b202307192024-01-16
CVE-2023-52041 [CRITICAL] CVE-2023-52041: An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code
An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program.
nvd
CVE-2023-46978P3HIGHCVSS 7.5v9.4.0cu.852_b202307192023-10-31
CVE-2023-46978 [HIGH] CWE-306 CVE-2023-46978: TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset
TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication.
nvd
CVE-2024-1661P4MEDIUMCVSS 5.5v9.4.0cu.852_b202307192024-02-20
CVE-2024-1661 [MEDIUM] CWE-798 CVE-2024-1661: A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affect
A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears t
nvd
CVE-2025-25524P4MEDIUMCVSS 5.1v9.4.0cu.652_b202301162025-02-11
CVE-2025-25524 [MEDIUM] CWE-120 CVE-2025-25524: Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of l
Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length verification, which is related to the addition of Wi-Fi filtering rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
nvd
← Previous3 / 3