CVE Feed

    Dashboard / CVE / CVE-2024-52723

    CVE-2024-52723

    In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.

    Published:Nov 22, 2024
    Last Modified:Mar 13, 2025
    EPS:Nov 22, 2024
    EPSS Score:0.00403
    CVSS Score:9.8

    Affected Products

    Vendor
    Totolink
    Product
    X6000r
    Vendor
    Totolink
    Product
    X6000r Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-4611 (CVSS 8.6) — A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue…
    CVE-2025-70328 (CVSS 8.8) — TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost …
    CVE-2026-1723 (CVSS 9.2) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-11005 (CVSS 9.3) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-52907 (CVSS 7.3) — Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This is…
    CVE-2025-52906 (CVSS 9.3) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-52905 (CVSS 7) — Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through …
    CVE-2025-52053 (CVSS 9.8) — TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D…
    CVE-2025-52284 (CVSS 6.5) — Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184…
    CVE-2025-25524 (CVSS 5.1) — Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length veri…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High