CVE-2026-1723CWE-78

TOTOLINK X6000R Unauthenticated Command Injection Vulnerability

Critical · published January 30, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
63.0
In the wild
Unconfirmed
What it is

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1498_B20250826.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01014 · 63.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-01-30T20:52Z
EPSS history
Timeline
  • 30 JAN 20:52Z
    TOTOLINK X6000R Unauthenticated Command Injection Vulnerability
    cvelistv5