CVE-2025-52906: TOTOLINK X6000R Command Injection Vulnerability
Published Sep 24, 2025
·Updated
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1360B20241207.
Affected Software
3 affected components
TOTOLINK X6000R<=V9.4.0cu.1360_B20241207
All of the following
TOTOLINK X6000R Firmware<=9.4.0cu.1360_b20241207
TOTOLINK X6000R
Event History
Sep 24, 2025
CVE Published
via MITRE·05:44 PM
Data Sourced
via MITRE·05:44 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-52906?
CVE-2025-52906 is considered a high severity vulnerability due to its potential for OS command injection.
2
How do I fix CVE-2025-52906?
To fix CVE-2025-52906, update TOTOLINK X6000R to a version beyond V9.4.0cu.1360_B20241207.
3
What is the impact of CVE-2025-52906?
The impact of CVE-2025-52906 allows an attacker to execute arbitrary OS commands on the affected device.
4
Which versions of TOTOLINK X6000R are affected by CVE-2025-52906?
CVE-2025-52906 affects TOTOLINK X6000R up to and including version V9.4.0cu.1360_B20241207.
5
What type of vulnerability is CVE-2025-52906 classified as?
CVE-2025-52906 is classified as an OS Command Injection vulnerability.