X6000R Firmware
57 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for X6000R Firmware, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.
X6000R Firmware CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 1 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 1 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 1 |
| 2025-08 | 0 |
| 2025-09 | 5 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 57 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical46
- High6
- Medium4
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting X6000R Firmware.
- CVE-2026-4611TOTOLINK X6000R shttpd setLanCfg privilege escalation7.2
- CVE-2025-70328TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The host_time parameter is retrieved via su...8.8
- CVE-2025-11005TOTOLINK X6000R Unauthenticated Command Injection Vulnerability9.8
- CVE-2025-52907TOTOLINK X6000R Security Bypass Vulnerability8.8
- CVE-2025-52906TOTOLINK X6000R Command Injection Vulnerability9.8
- CVE-2025-52905TOTOLINK X6000R Argument Injection Vulnerability7.5
- CVE-2025-52053TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vulnerability allows unauthenticated atta...9.8
- CVE-2025-52284Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers t...6.5
- CVE-2025-25524Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length verification, which is related to the addition of Wi-Fi filtering rules. Attackers who succ...5.1
- CVE-2024-52723In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructi...9.8
- CVE-2024-7907TOTOLINK X6000R cstecgi.cgi setSyslogCfg command injection6.3
- CVE-2024-2353Totolink X6000R shttpd cstecgi.cgi setDiagnosisCfg os command injection8.8
- CVE-2024-1781Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection6.3
- CVE-2024-1661Totolink X6000R shadow hard-coded credentials2.5
- CVE-2023-52039An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.9.8
Product grouping is registry-driven, with AI assist and human review. How it works