CVE-2026-105484 TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection
Remote attackers can execute arbitrary OS commands on TOTOLINK X6000R routers via the firmware upload handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105484?
CVE-2026-105484 is a critical command injection vulnerability in TOTOLINK X6000R, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.
Which versions are affected by CVE-2026-105484?
How do I fix CVE-2026-105484?
No fix has been published for CVE-2026-105484 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-105484 being exploited?
There is no known exploitation of CVE-2026-105484 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-34j5-jp28-25g9.