Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection
Totolink · X6000R AX3000
The Totolink X6000R AX3000 router (firmware 9.4.0cu.852_20230719) contains a command injection flaw in the setWizardCfg function of /cgi-bin/cstecgi.cgi within the shttpd web server component. An attacker with network access to the device, and without needing credentials or user interaction, can supply crafted input to that function to inject and run operating system commands.
A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation leads to command injection. The exploit has been disclosed to the public and may be used. The identifier VDB-254573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 20 months after disclosure. Public exploit code (PoC-in-GitHub) was available 11 days before disclosure.
- Public exploit codePoC-in-GitHub11 days before
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+20 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 9 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- EbeeJuly2026 Pt16 Jul 2026
- RustDuck: An In-Depth Analysis of a Two-Stage Botnet3 Jul 2026
- RustDuck: An In-Depth Analysis of a Two-Stage Botnet2 Jul 2026
- RustDuck: An In-Depth Analysis of a Two-Stage Botnet.1 Jul 2026
- RondoDox | Guest System attacking | EuroTarget16 Jan 2026
- From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits15 Oct 2025
- 3 more on OTX