CVE-2024-1781 is a command injection in the Totolink X6000R AX3000 router, firmware 9.4.0cu.852_20230719. NVD scores it 6.3 (Medium). No vendor fix is named in the record, and the vendor did not respond to the researcher. Limit access to the admin interface and check for new firmware.
What's affected
Totolink X6000R AX3000 running firmware 9.4.0cu.852_20230719. The record lists the hardware X6000R together with that one firmware build.
The flaw sits in the function setWizardCfg of the file /cgi-bin/cstecgi.cgi, part of the shttpd web server component. The weakness is CWE-77, command injection. The description says the manipulation leads to command injection, that the exploit has been disclosed publicly, and that the vendor was contacted early but never answered.
Severity conflict. The description, which is written in the VulDB style, calls the issue critical. NVD's own CVSS 3.1 score is 6.3, which is Medium, with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That vector uses an adjacent network attack path and low impact ratings, which is the main reason it lands below critical. Both ratings are published, so plan around the worse one if the device is reachable from untrusted networks.
The record names no fixed version.
How to check if you're exposed
Log in to the router's admin page and read the model and firmware version, usually under System, Status or About. Compare it with the version named above.
You can also check from your own network without logging in, by looking at the device label for the model and revision, then matching it to the list above. Revision matters, because vendors often ship several hardware revisions under one model name.
Two more checks are worth doing on any consumer or small office router:
nmap -p 23,80,443,8080 192.168.0.1
Replace the address with your router's. If the management interface answers on a port you did not expect, or on the WAN side, that is a finding in its own right. Only scan devices you own or administer.
What to do now
- Identify every affected model on your network, including routers at remote offices and at employees' homes if you manage them.
- Check the vendor support page for a firmware release that names this CVE. The record says the vendor did not respond to the disclosure, so a fix may not exist.
- Turn off remote management on the WAN side and limit the admin interface to a trusted LAN segment or VLAN.
- Change the default admin password and make sure it is unique to the device.
- If no fix is available and the device is exposed, plan to replace it with supported hardware.
Why it matters
Command injection means input from a request ends up inside a command that the device runs. On a router, commands run with high privilege, so a successful attack can mean control of the device and of the traffic that passes through it.
The record scores this lower than a typical router bug because its vector uses an adjacent network attack path, which means the attacker must be on the same local network segment, and it rates the impacts as low. Public disclosure of the exploit still raises the risk, since anyone can now read how it works.
Router firmware tends to get little attention after sale, and this record shows the pattern: the vendor was contacted and did not reply. The practical defence is network design, with the admin interface kept off the internet and off untrusted segments.
The record's CISA Known Exploited Vulnerabilities flag is false, and no retrieved source reports exploitation in the wild.
Quick check
Is there a patched firmware?
The record names none and says the vendor did not respond. Check the Totolink support page for newer firmware and read its release notes for this CVE.
Is it rated Medium or critical?
Both. NVD scores it 6.3 (Medium), while the description text calls it critical. Treat it as serious if the router faces untrusted users.
Sources
- NVD record for CVE-2024-1781
- VulDB entry 254573 (listed in the record, not retrievable when reviewed)
Last reviewed: 19 October 2026.
