CVE-2025-11005 is a critical severity (CVSS 9.8) OS command injection flaw in the TOTOLINK X6000R router. Firmware through V9.4.0cu.1458_B20250708 is affected, and the weakness needs no login. TOTOLINK has released patched firmware, so install it from the vendor download page and keep the admin interface off the internet.
What's affected
The NVD record lists TOTOLINK X6000R firmware through V9.4.0cu.1458_B20250708. Palo Alto Networks Unit 42 published a disclosure for the same range and says the flaw is in the setWiFiAclRules function, where the desc value is used to build a system command without being cleaned.
Unit 42 also says TOTOLINK acknowledged the problem and released a patched firmware version. The advisory does not name the fixed build in the text we read, so use the TOTOLINK download page for the X6000R and confirm the version number there. Weakness class: CWE-78.
How to check if you're exposed
Log in to the router admin page and read the firmware version on the status or upgrade page. Compare it with the build named above. If it is at or below V9.4.0cu.1458_B20250708, treat the device as exposed.
Then check whether the admin interface is reachable from the internet. From a machine outside your network, try to open the router's public address on its admin port. If it answers, remote management is on and you should turn it off.
What to do now
- Download the patched firmware for the X6000R from the TOTOLINK site and confirm the new version number after the update.
- Turn off remote management so the admin page is not reachable from the internet.
- Change the admin password and review the Wi-Fi access rules for entries you did not create.
- If the router cannot be updated, replace it, and keep it out of any network that holds sensitive systems.
- Record the device and firmware version in your inventory so the next advisory is easy to match.
Why it matters
Command injection means the firmware builds a shell command from input and runs it. Anything the attacker adds can run with the privileges of the web service on the router, which is usually everything. The record scores the weakness at the top of the scale with no login required.
Routers sit at the edge of your network, see all traffic, and rarely get patched on a schedule. That mix is why a flaw like this deserves a quick firmware update and a check of the remote management setting. The weakness is CWE-78. The record's KEV flag is false, and the advisory we read does not report exploitation, so do not assume it is being used, but do not wait either.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this flaw being exploited in the wild?
The record's KEV flag is false, and the advisory we read does not say so. That can change, so patch promptly.
Do I need to be logged in to the router?
The record and the Unit 42 advisory describe it as exploitable without authentication.
Sources
- NVD record for CVE-2025-11005
- Palo Alto Networks Unit 42 disclosure PANW-2025-0005
- Palo Alto Networks Unit 42 disclosure PANW-2025-0005
- Safeguard Gold page for CVE-2025-11005
Last reviewed: 19 October 2026.
