Product:
X6000R
Summary
Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection and File Manipulation. This issue affects X6000R through V9.4.0cu.1360_B20241207. Attackers can exploit this vulnerability to execute arbitrary commands on the device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.3 | CVE-2025-52907 |
Exploitation
To exploit this vulnerability, an attacker must have network access to the affected device. By sending specially crafted input to the device, the attacker can manipulate commands and potentially gain unauthorized access or control over the device. This requires a high level of attack complexity and user interaction.
Affected Products
- X6000R: Affected from version V9.4.0cu.1360_B20241207 and onwards, vulnerable to command injection and file manipulation.
Mitigation
To mitigate this vulnerability, users should update their TOTOLINK X6000R devices to the latest firmware version provided by the vendor. Additionally, implementing network security measures such as firewalls and access controls can help limit exposure to potential attacks.