Deviceways

Router

TOTOLINK X6000R

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
Hardware revision not specified
Get OpenWrt firmware Release listed · 25.12.6
(V1)
Open hardware record
V2
Open hardware record
Original project github.com

Recorded configuration: 16 MB flash; 256 MB RAM

First installation
U-Boot web recovery
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

TOTOLINK X6000R — TechInfoDepot (github.com)

Hardware revision
(V1)

Device details

TOTOLINK X6000RV2 — TechInfoDepot (github.com)

Hardware revision
V2

OpenWrt

OpenWrt — Source documentation (openwrt.org)

Installation routes recorded
U-Boot web recovery
Recovery routes recorded
U-Boot web recovery
Availability recorded by source
Available 2025

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 10.0 (v4.0)

X6000R

TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

CVE-2026-105484

Affected firmware
9.4.0cu.652_B20230116
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.

VDB-413619 | TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection — X6000R (vuldb.com) ↗VDB-413619 | CTI Indicators (IOB, IOC, TTP, IOA) — X6000R (vuldb.com) ↗CVE-2026-105484 | CVE Analysis and Report — X6000R (vuldb.com) ↗Submit #984434 | TOTOLINK X6000R 9.4.0cu.652_B20230116 CWE-78 OS Command Injection — X6000R (vuldb.com) ↗
CVE published

CVSS 9.8 (v3.1)

TOTOLINK X6000R

TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter

CVE-2025-52053

Affected firmware
X6000R: V9.4.0cu.1360_B20241207 was found to
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.

CVE-2025-52053 record (github.com) ↗
CVE published

CVSS 9.8 (v3.1)

TOTOLINK X6000R

In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering

CVE-2024-52723

Affected firmware
X6000R: V9.4.0cu.1041_B20240224 in the shttpd file
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.

CVE published

CVSS 9.8 (v3.1)

TOTOLINK X6000R

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.

CVE-2023-52039

Affected firmware
X6000R: v9.4.0cu.852_B20230719
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.

CVE published

CVSS 9.8 (v3.1)

TOTOLINK X6000R

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.

CVE-2023-52038

Affected firmware
X6000R: v9.4.0cu.852_B20230719
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.

Check more security advisories for this device · CVE.org