Remote Command Injection in TOTOLINK X6000R Firmware

CVE-2026-105484 identifies a critical security vulnerability in the TOTOLINK X6000R router, specifically affecting firmware version 9.4.0cu.652_B20230116. The vulnerability exists within the 'UploadFirmwareFile' handler, which processes requests through the '/cgi-bin/cstecgi.cgi' script. An attacker can manipulate the 'file_name' argument during a firmware upload operation to inject arbitrary OS commands.

Because this vulnerability is accessible remotely and does not appear to require authentication, it represents a significant risk for device takeover. Successful exploitation allows for complete administrative control over the affected network equipment, enabling further malicious activities such as traffic interception, persistent backdoor installation, and pivoting into the local network. Defenders should monitor web server logs for irregular requests targeting the specified CGI endpoint, specifically looking for shell metacharacters in query parameters.

Impact

Successful exploitation results in full remote code execution on the affected router. This level of access grants the attacker the ability to reconfigure the device, exfiltrate network data, or use the device as an initial access point for lateral movement within the target network. Given that this affects router firmware, it could lead to sustained device compromise if not addressed.

Recommendation

• Monitor web server traffic for POST requests to /cgi-bin/cstecgi.cgi that contain suspicious shell metacharacters in the file_name parameter.
• Restrict access to the management interface of TOTOLINK X6000R devices to trusted administrative IP addresses only.
• Review device logs for unauthorized firmware modification attempts or unexpected process execution initiated by the web server process.
• Consult the vendor for firmware updates that address the insecure handling of the file_name argument in the UploadFirmwareFile handler.