CVE-2026-4611
Published: 23 March 2026
Description
A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attack may be launched remotely.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates OS command injection by requiring validation and sanitization of untrusted inputs like the Hostname argument to the setLanCfg function.
Addresses the specific flaw in the shttpd component by requiring timely identification, reporting, and correction of vulnerabilities like CVE-2026-4611 through patching.
Limits the impact of successful command injection by enforcing least privilege, reducing the privileges available to high-privilege (PR:H) attackers exploiting the vulnerability.
Security SummaryAI
CVE-2026-4611 is an OS command injection vulnerability affecting the TOTOLINK X6000R router running firmware versions 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826. The flaw resides in the setLanCfg function within the /usr/sbin/shttpd component, where manipulation of the Hostname argument enables arbitrary command execution. This issue corresponds to CWE-77 (Command Injection) and CWE-78 (OS Command Injection) and has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
A remote attacker with high privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing full system compromise, such as executing arbitrary commands on the underlying operating system.
Advisories detailing the vulnerability are available from VulDB at https://vuldb.com/?ctiid.352475, https://vuldb.com/?id.352475, and https://vuldb.com/?submit.775642, along with the vendor site at https://www.totolink.net/. Specific mitigation or patch information should be consulted from these sources.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an OS command injection in a public-facing router web interface (/usr/sbin/shttpd setLanCfg), enabling exploitation of a public-facing application (T1190) to achieve arbitrary Unix shell command execution (T1059.004).