CVE-2026-4611

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-4611
A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attack may be launched remotely.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

8.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:M/C:C/I:C/A:C

Exploitability : 6.4 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://vuldb.com/?ctiid.352475 Permissions Required VDB Entry
https://vuldb.com/?id.352475 Third Party Advisory VDB Entry
https://vuldb.com/?submit.775642 Third Party Advisory VDB Entry
https://www.totolink.net/ Product
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:totolink:x6000r_firmware:9.4.0cu.1360_b20241207:*:*:*:*:*:*:*
cpe:2.3:o:totolink:x6000r_firmware:9.4.0cu.1498_b20250826:*:*:*:*:*:*:*
cpe:2.3:h:totolink:x6000r:-:*:*:*:*:*:*:*
History

03 Apr 2026, 11:31

Type Values Removed Values Added
First Time Totolink
Totolink x6000r
Totolink x6000r Firmware
Summary
  • (es) Se ha encontrado una falla en TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Afectada por este problema está la función setLanCfg del archivo /usr/sbin/shttpd. La ejecución de una manipulación del argumento Hostname puede conducir a una inyección de comandos del sistema operativo. El ataque puede ser lanzado de forma remota.
CPE cpe:2.3:h:totolink:x6000r:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:x6000r_firmware:9.4.0cu.1498_b20250826:*:*:*:*:*:*:*
cpe:2.3:o:totolink:x6000r_firmware:9.4.0cu.1360_b20241207:*:*:*:*:*:*:*
References () https://vuldb.com/?ctiid.352475 - () https://vuldb.com/?ctiid.352475 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.352475 - () https://vuldb.com/?id.352475 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.775642 - () https://vuldb.com/?submit.775642 - Third Party Advisory, VDB Entry
References () https://www.totolink.net/ - () https://www.totolink.net/ - Product

23 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-23 22:16

Updated : 2026-04-03 11:31

NVD link : CVE-2026-4611

Mitre link : CVE-2026-4611

CVE.ORG link : CVE-2026-4611

JSON object : View

Products Affected

totolink

  • x6000r
  • x6000r_firmware
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')