CVE-2026-4611 HIGH

CVE-2026-4611: TOTOLINK X6000R shttpd setLanCfg privilege escalation

Vendor Totolink
Product X6000R
Weakness CWE-78
Published March 23, 2026
Last update March 25, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X

What the vulnerability does

01Description

A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attack may be launched remotely.

Key dates

02Disclosure timeline

March 23, 2026 CVE published
March 25, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-6992 Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injection CVE-2026-20008 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Lua Code Injection Vulnerability CVE-2026-5844 D-Link DIR-882 HNAP1 SetNetworkSettings prog.cgi sprintf os command injection CVE-2023-40145 Weintek cMT3000 HMI Web CGI OS Command Injection CVE-2025-2367 Oiwtech OIW-2431APGN-HP Personal Script Submenu formScript os command injection