Command Injection Vulnerability in Totolink Router Software
CVE-2025-52284

6.5MEDIUM

Key Information:

Vendor

Totolink
Status
X6000R
Vendor
CVE Published:
29 July 2025

What is CVE-2025-52284?

A command injection vulnerability has been identified in the Totolink X6000R router software. This flaw arises from improper handling of the tz parameter in the sub_4184C0 function. Attackers, without authentication, can exploit this vulnerability to execute arbitrary commands on the affected device through crafted requests, posing significant risks to network integrity and security.

References

https://www.notion.so/setNtpCfg-20e8aff2dc8b80a3afafef36b...

EPSS Score

43% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.