TOTOLINK X6000R: OS command injection in firmware upload handler
Summary
The web management CGI (/cgi-bin/cstecgi.cgi) of the TOTOLINK X6000R router firmware 9.4.0cu.652_B20230116 does not properly neutralize the file_name argument of the firmware_check function in the UploadFirmwareFile handler. A remote attacker can inject operating system commands, which can lead to full control over the router. According to the CVSS 4.0 vector, no privileges or user interaction are required, but the exact authentication requirement is not confirmed by the CNA or NVD.
Affected
- TOTOLINK X6000R 9.4.0cu.652_B20230116 (only version listed by the CNA)
- Other firmware builds: Unknown.
Fixed in
- Unknown. No vendor fix or advisory found.
- TOTOLINK recommended the latest available firmware (V9.4.0cu.1498_B20250826) for earlier X6000R flaws; whether it addresses this CVE is unverified.
Workaround
- Disable remote (WAN) management and keep the admin interface off the internet.
- Place the router in a dedicated VLAN with strict ingress and egress filtering.
- Restrict access to the admin interface to trusted management hosts.
Exploitation
- Known exploited: No (not listed in CISA KEV per available sources; not verified directly).
- Public proof of concept: None found in the sources reviewed; one third-party source claims exploit references exist but names none.
- CISA SSVC: Exploitation none, automatable yes, technical impact total.
Our recommendation
- Check whether the admin interface of every X6000R is reachable from the internet and disable remote management if possible.
- Check the firmware version; if it is 9.4.0cu.652_B20230116, plan an update to the latest firmware once TOTOLINK publishes a fix.
- Monitor totolink.net and the NVD entry for advisories and analysis updates.
- If the device is exposed or cannot be patched, replace it with a supported model.
- Review router logs for unusual access to /cgi-bin/cstecgi.cgi.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
xiaobai718-ab/CVE-2026-105484
Research sources
- VulDB CVE-2026-105484 vuldb.com
- VulDB CTI entry vuldb.com
- TOTOLINK website www.totolink.net
- Palo Alto Unit 42: TOTOLINK X6000R vulnerabilities unit42.paloaltonetworks.com
- GBHackers: TOTOLINK X6000R routers hit by three vulnerabilities gbhackers.com
- TheHackerWire CVE-2026-105484 www.thehackerwire.com
- Brinztech alert CVE-2026-105484 www.brinztech.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:41.
Original description (NVD)
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.