Description
A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attack may be launched remotely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TOTOLINK | X6000R | 9.4.0cu.1360_B20241207, 9.4.0cu.1498_B20250826 | — |
References
- VDB-352475 | TOTOLINK X6000R shttpd setLanCfg privilege escalation vdb-entry technical-description
- VDB-352475 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #775642 | Totolink X6000R V9.4.0cu.1360_B20241207/V9.4.0cu.1498_B20250826 OS Command Injection third-party-advisory
- https://www.totolink.net/ product