CVE-2023-52040

The issue concerns the sub_41284C function in TOTOLINK X6000R firmware version 9.4.0cu.852_B20230719. This function does not properly validate input data, which allows injection and execution of arbitrary system commands (command injection). The attack does not require authentication, user interaction, or special privileges — network access to the device is sufficient.

An attacker can take full control of the device by executing arbitrary system commands with the privilege level of the process handling the vulnerable function, which may lead to breaches of confidentiality, integrity, and system availability.

Security patches available from the manufacturer should be applied in accordance with the references. Until an update is available, it is recommended to restrict access to the device management panel exclusively from trusted networks and block Internet access using a firewall.

TOTOLINK X6000R Firmware version 9.4.0cu.852_B20230719