CVE-2025-52053: Command Injection

Published Sep 15, 2025

Updated

TOTOLINK X6000R V9.4.0cu.1360B20241207 was found to contain a command injection vulnerability in the sub417D74 function via the filename parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.

Affected Software

3 affected components

TOTOLINK X6000R

All of the following

TOTOLINK X6000R Firmware=9.4.0cu.1360_b20241207

TOTOLINK X6000R

Event History

Sep 15, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-52053?

CVE-2025-52053 is classified as a high-severity vulnerability due to its potential for unauthenticated remote command execution.

How do I fix CVE-2025-52053?

To fix CVE-2025-52053, update the TOTOLINK X6000R firmware to the latest version provided by the manufacturer.

What type of vulnerability is CVE-2025-52053?

CVE-2025-52053 is a command injection vulnerability that allows attackers to execute arbitrary commands.

Who is affected by CVE-2025-52053?

Any users of the TOTOLINK X6000R router running version V9.4.0cu.1360_B20241207 are affected by CVE-2025-52053.

Is authentication required to exploit CVE-2025-52053?

No, CVE-2025-52053 can be exploited by unauthenticated attackers.