Product:
X6000R
Summary
A vulnerability in TOTOLINK X6000R allows for OS Command Injection due to improper neutralization of special elements used in an OS command. This issue affects devices running through V9.4.0cu.1458_B20250708. The vulnerability can lead to unauthorized command execution on the affected devices.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2025-11005 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted network packets to the affected device. By manipulating the input parameters, the attacker can inject malicious OS commands that the device will execute. This can lead to unauthorized access and control over the device, potentially compromising the network it is connected to.
Affected Products
- X6000R: Affected versions include those running through V9.4.0cu.1458_B20250708, which are vulnerable to OS command injection attacks.
Mitigation
To mitigate this vulnerability, users should update their TOTOLINK X6000R devices to the latest firmware version provided by the vendor. Additionally, it is recommended to implement network security measures such as firewalls and intrusion detection systems to monitor and block suspicious activities.