CVE-2026-105484: OS Command Injection in TOTOLINK X6000R

This vulnerability affects TOTOLINK X6000R version 9.4.0cu.652_B20230116. The issue is an OS command injection in the firmware_check function of the /cgi-bin/cstecgi.cgi file, part of the UploadFirmwareFile Handler. By manipulating the file_name parameter, an unauthenticated remote attacker can execute arbitrary operating system commands, potentially leading to full system compromise. The CVSS v4.0 base score is 10.0, indicating maximum severity with network attack vector, no required privileges or user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the device, including control over firmware and system functions. This can result in loss of confidentiality, integrity, and availability of the device and network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device's management interface to trusted users only and monitor for suspicious activity targeting the /cgi-bin/cstecgi.cgi endpoint. Avoid exposing the device management interface to untrusted networks.