TOTOLINK X6000R: THREE NEW VULNERABILITIES UNCOVERED

Summary from the TLDR InfoSec newsletter

There are three critical vulnerabilities in TOTOLINK X6000R routers (CVE-2025-52905, CVE-2025-52906, and CVE-2025-52907) that allow unauthenticated attackers to execute arbitrary commands and bypass security controls via the router's web interface. The vulnerabilities stem from inadequate input sanitization in the cstecgi.cgi endpoint, with the blocklist failing to filter hyphen characters, and enabling argument injection, command injection, and arbitrary file manipulation attacks. TOTOLINK has released patched firmware (V9.4.0cu.1498_B20250826). Users are strongly advised to update immediately as these flaws could allow attackers to gain root access, intercept traffic, and pivot to other network devices.