CVE-2025-52906

9.3 criticalEPSS 13%

Critical (9.3) in totolink x6000r firmware. EPSS 13% chance of exploitation in the next 30 days.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1360_B20241207.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H/S:N/AU:Y/R:U

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2025-09-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

totolink:x6000r_firmware

References

https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0002/PANW-2025-0002.md
https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html

Check your stack JSON