CVE-2025-52905CWE-20

CVE-2025-52905

High · published September 23, 2025

CVSS v3.1

7.5

EPSS

8%

Percentile

95.0

In the wild

Unconfirmed

What it is

Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through V9.4.0cu.1360_B20241207.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.08445 · 95.0th percentile
Weakness: CWE-20 · Improper Input Validation
Published: 2025-09-23T22:15Z

Affected products (1)

Product	Versions	Fixed in
totolink/x6000r_firmware	≤ 9.4.0cu.1360_b20241207	—

References (2)

https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0001/PANW-2025-0001.md · [email protected]https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html · [email protected]

EPSS history

Timeline

23 SEP 17:53Z
TOTOLINK X6000R Argument Injection Vulnerability
cvelistv5