An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.
The issue concerns the sub_41284C function in TOTOLINK X6000R firmware version 9.4.0cu.852_B20230719. This function does not properly validate input data, which allows injection and execution of arbitrary system commands (command injection). The attack does not require authentication, user interaction, or special privileges β network access to the device is sufficient.
An attacker can take full control of the device by executing arbitrary system commands with the privilege level of the process handling the vulnerable function, which may lead to breaches of confidentiality, integrity, and system availability.
Security patches available from the manufacturer should be applied in accordance with the references. Until an update is available, it is recommended to restrict access to the device management panel exclusively from trusted networks and block Internet access using a firewall.
TOTOLINK X6000R Firmware version 9.4.0cu.852_B20230719
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HTotolink X6000r
HWTotolinkwszystkie wersjeTotolink X6000r Firmware
OSTotolink9.4.0cu.852_b20230719
Related vulnerabilities
OS Command Injection w TOTOLINK X6000R β zdalne wykonanie poleceΕ
OS Command Injection w firmware routera TOTOLINK X6000R
Command injection w TOTOLINK X6000R β zdalne wykonanie kodu bez uwierzytelnienia
Command injection w TOTOLINK X6000R β zdalne wykonanie poleceΕ bez uwierzytelnienia
Command Injection w TOTOLINK X6000R β wykonanie dowolnych poleceΕ