CVE-2026-4611
Published: 23 March 2026
Summary
CVE-2026-4611 is a high-severity Command Injection (CWE-77) vulnerability in Totolink X6000R Firmware. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A command injection vulnerability has been identified in the TOTOLINK X6000R router firmware versions 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826. The flaw resides in the setLanCfg function within /usr/sbin/shttpd and is triggered by improper handling of the Hostname argument, allowing operating system command injection as classified under CWE-77 and CWE-78. The issue is remotely reachable and carries a CVSS 4.0 score of 8.6.
An authenticated administrator can supply a crafted Hostname value over the network to execute arbitrary commands on the device, resulting in full compromise of confidentiality, integrity, and availability without requiring user interaction. The attack vector is rated as network-accessible with low complexity once administrative credentials are obtained.
Public references point to VulDB entries and the vendor site but contain no explicit details on patches, firmware updates, or mitigation steps. The associated EPSS scores remain low, with a current value of 0.0124 and a peak of 0.0159, indicating limited observed exploitation interest to date.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14603
Vulnerability details
A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attack may be launched remotely.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an OS command injection in a public-facing router web interface (/usr/sbin/shttpd setLanCfg), enabling exploitation of a public-facing application (T1190) to achieve arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates OS command injection by requiring validation and sanitization of untrusted inputs like the Hostname argument to the setLanCfg function.
Addresses the specific flaw in the shttpd component by requiring timely identification, reporting, and correction of vulnerabilities like CVE-2026-4611 through patching.
Limits the impact of successful command injection by enforcing least privilege, reducing the privileges available to high-privilege (PR:H) attackers exploiting the vulnerability.