OS Command Injection in TOTOLINK X6000R Products
CVE-2026-4611

8.6HIGH

Key Information:

Vendor

Totolink
Status
X6000r
Vendor
CVE Published:
23 March 2026

What is CVE-2026-4611?

A vulnerability exists in the TOTOLINK X6000R network device, specifically within the setLanCfg function located in /usr/sbin/shttpd. Attackers can exploit this flaw by manipulating the Hostname argument, leading to potential OS command injection. This vulnerability allows for remote execution of commands, posing a significant risk to the integrity and security of the affected devices.

Affected Version(s)

X6000R 9.4.0cu.1360_B20241207

X6000R 9.4.0cu.1498_B20250826

References

https://vuldb.com/?id.352475
vdb-entrytechnical-description
https://vuldb.com/?ctiid.352475
signaturepermissions-required
https://vuldb.com/?submit.775642
third-party-advisory

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

1935648903 (VulDB User)
VulDB
.