CVE-2025-52906 is a critical OS command injection flaw (CVSS 9.8) in the TOTOLINK X6000R router. Firmware up to V9.4.0cu.1360_B20241207 is affected, and an unauthenticated network user can run commands on the device. TOTOLINK has released patched firmware, so install it from the vendor download page.
What's affected
The NVD record says the issue affects the X6000R through firmware V9.4.0cu.1360_B20241207. Palo Alto Networks Unit 42, which disclosed it as PANW-2025-0002, says versions up to and including that build are affected.
According to that disclosure, the flaw sits in the setEasyMeshAgentCfg function, which handles EasyMesh agent settings. The user supplied agentName value is not sanitised before it is used to build a system command. The weakness is CWE-78, OS command injection.
Unit 42 states that TOTOLINK acknowledged the report and released a patched firmware version. It does not name the version, so confirm the exact build on the TOTOLINK download page for the X6000R.
How to check if you're exposed
Open the router admin page and read the firmware version on the status or system page. If it reads V9.4.0cu.1360_B20241207 or any earlier build, treat the device as affected.
Then ask who can reach the admin interface. The disclosure rates exploitability as high because any unauthenticated network user can reach the function, so the question is whether that network includes the internet, a guest Wi-Fi, or a shared office segment. Check for remote management being switched on and for port forwards to the router itself.
Small office and branch sites often run consumer grade routers that nobody tracks. Walk your site list and ask for the model name from each location.
What to do now
- Find every TOTOLINK X6000R in use and record the firmware build.
- Download the patched firmware for the X6000R from the TOTOLINK download page and install it. Verify the new build number afterwards.
- Turn off remote management on the WAN side, and limit the admin page to a trusted management address.
- Check that the router is not exposed through port forwards or UPnP mappings you did not intend.
- If the device cannot be updated, plan to replace it. An unpatched router with command execution is a foothold into everything behind it.
Why it matters
Command injection is what happens when a program puts text from a request into a command line and does not neutralise shell special characters first. The shell then treats part of the input as a second command. On a router that command runs with the device's own privileges, and the device sits between your network and the internet.
An attacker with a shell on a gateway can watch or redirect traffic, change DNS settings, or use the device as a base for further attacks. Neither the record nor the disclosure says this CVE is exploited, and it is not in the CISA Known Exploited Vulnerabilities list. Edge devices are, however, a frequent target, so a fix that is a firmware upload away is worth doing the same week.
Quick check
Do I need a password to be attacked?
The Unit 42 disclosure says no. It describes any unauthenticated network user as able to reach the vulnerable function, so limiting who can reach the admin interface matters.
Sources
Last reviewed: 18 October 2026.
