CVE-2023-52041 is a critical severity (9.8 CVSS) command injection in the TOTOLINK X6000R router, firmware V9.4.0cu.852_B20230719. Per NVD it allows attackers to run arbitrary code via the sub_410118 function of the shttpd web server. We could not confirm a fixed firmware, so check TOTOLINK's site and restrict management access.
What's affected
The NVD record lists TOTOLINK X6000R firmware V9.4.0cu.852_B20230719 and the X6000R hardware. The researcher write-up we fetched names the same build and does not mention other versions.
Neither the record nor the write-up names a patched firmware or a vendor advisory. We cannot state a fixed version. Check TOTOLINK's download and support pages for newer X6000R firmware, and confirm any update against the CVE record before relying on it.
How to check if you're exposed
Open the router's admin interface and read the firmware version on the system status page. If it reads V9.4.0cu.852_B20230719, treat it as affected.
Then check whether the web management service is reachable from outside the local network. Remote management that is enabled on the WAN side, or a management page reachable from guest Wi-Fi, widens the exposure a great deal. Only test devices you own.
What to do now
- Inventory X6000R routers and read their firmware versions.
- Look for newer firmware from TOTOLINK and apply it once confirmed.
- Disable remote management and limit the web interface to trusted internal hosts.
- Keep the management interface off untrusted networks, including guest Wi-Fi and the internet.
- Watch for unexpected configuration changes or unknown processes on the device, and plan replacement if no fix appears.
Why it matters
The write-up says values from the web management interface are joined into a string and passed to a system command routine without sanitization. The write-up classifies it as OS command injection (CWE-78), while the NVD record lists no CWE for this entry. The vector is network based with no privileges required, so an attacker who can reach the web service can run commands as the web server process.
Related TOTOLINK X6000R entries exist (CVE-2023-52038, CVE-2023-52039 and CVE-2023-52040) for the same firmware build, so a single device may carry several of these. The KEV flag is false for this CVE and the sources we read do not claim exploitation in the wild.
For a wider view, the free in-browser dependency scan and the Gold directory help you see which packaged components in your own code carry known CVEs, and reachability analysis helps you decide which ones matter first.
Quick check
Is there a fixed X6000R firmware?
We could not confirm one from the record or the write-up. Check TOTOLINK's support page and the CVE record, and restrict web management meanwhile.
Sources
Last reviewed: 19 October 2026.
