Product:
X6000R
Summary
A vulnerability in TOTOLINK X6000R allows for OS Command Injection due to improper neutralization of special elements used in an OS command. This issue affects devices running through V9.4.0cu.1498_B20250826. Attackers can exploit this vulnerability to execute arbitrary commands on the affected device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.2 | CVE-2026-1723 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted network packets to the affected device. By manipulating the input parameters, the attacker can inject OS commands that the device will execute with the same privileges as the device itself. This can lead to unauthorized access and control over the device.
Affected Products
- X6000R: Affected versions include those running through V9.4.0cu.1498_B20250826, which are vulnerable to OS command injection attacks.
Mitigation
To mitigate this vulnerability, users should update their TOTOLINK X6000R devices to the latest firmware version that addresses this issue. Additionally, it is recommended to implement network security measures to restrict unauthorized access to the device.