Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

TOTOLINK X6000R: Three New Vulnerabilities Uncovered

Summary: Unit 42 found three vulnerabilities in TOTOLINK X6000R router firmware version V9.4.0cu.1360_B20241207, released March 28, 2025, all reachable through the /cgi-bin/cstecgi.cgi endpoint that routes requests by its topicurl parameter. The firmware's input sanitization blocklist fails to filter the hyphen character, enabling unauthenticated argument injection in the setEasyMeshAgentCfg function's agentName parameter and arbitrary file writes through setWizardCfg, including modifying /etc/passwd or boot scripts.

What you should know: An attacker who can reach the router's web interface needs no credentials to execute commands with web server privileges or write files that add users and persist across reboots - and TOTOLINK has shipped a fix in V9.4.0cu.1498_B20250826 that only helps devices that actually get updated.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026