CVE Feed

    Dashboard / CVE / CVE-2025-25524

    CVE-2025-25524

    Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length verification, which is related to the addition of Wi-Fi filtering rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.

    Published:Feb 11, 2025
    Last Modified:Apr 29, 2025
    EPS:Feb 11, 2025
    EPSS Score:0.00046
    CVSS Score:5.1

    Affected Products

    Vendor
    Totolink
    Product
    X6000r
    Vendor
    Totolink
    Product
    X6000r Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-4611 (CVSS 8.6) — A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue…
    CVE-2025-70328 (CVSS 8.8) — TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost …
    CVE-2026-1723 (CVSS 9.2) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-11005 (CVSS 9.3) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-52907 (CVSS 7.3) — Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This is…
    CVE-2025-52906 (CVSS 9.3) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-52905 (CVSS 7) — Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through …
    CVE-2025-52053 (CVSS 9.8) — TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D…
    CVE-2025-52284 (CVSS 6.5) — Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184…
    CVE-2024-52723 (CVSS 9.8) — In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High