Volerion logoVolerion
Volerion logoVolerion

Totolink X6000R Command Injection Vulnerability in NTP Configuration

Vulnerability

A command injection vulnerability has been identified in the Totolink X6000R router, specifically in version V9.4.0cu.1360_B20241207. The issue arises in the sub_4184C0 function, where the tz parameter can be manipulated to execute arbitrary commands. This vulnerability can be exploited by unauthenticated attackers through a crafted request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Added: Jul 29, 2025, 6:47 PM
Updated: Jul 29, 2025, 7:43 PM

Vulnerability Rating

Custom Algorithm
spread
0.3
impact
10.0
exploitability
7.0
remediation
0.0
relevance
0.3
threat
0.7
urgency
2.9
incentive
5.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.