CVE-2025-70328
OS Command Injection in TOTOLINK X6000R NTPSyncWithHost Handler
Publication date: 2026-02-23
Last updated on: 2026-02-26
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | x6000r_firmware | 9.4.0cu.1498_b20250826 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in TOTOLINK X6000R version 9.4.0cu.1498_B20250826 within the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. It is an OS command injection flaw where the host_time parameter is obtained and passed to a shell command (date -s) without proper sanitization. Although the first two tokens of the input are validated, the rest of the input is not sanitized, allowing an authenticated attacker to inject arbitrary shell commands using shell metacharacters.
How can this vulnerability impact me? :
This vulnerability allows an authenticated attacker to execute arbitrary shell commands on the affected device. This can lead to unauthorized control over the device, potentially allowing the attacker to manipulate system settings, access sensitive data, disrupt device functionality, or use the device as a foothold for further attacks within the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves an OS command injection in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable, specifically via the host_time parameter. Detection can focus on monitoring or testing this parameter for injection attempts.'}, {'type': 'paragraph', 'content': 'Since the vulnerability allows arbitrary shell commands via shell metacharacters in the host_time parameter, you can attempt to detect it by sending crafted requests to the affected service and observing the response or system behavior.'}, {'type': 'list_item', 'content': 'Use curl or similar tools to send authenticated requests to the NTPSyncWithHost endpoint with payloads containing shell metacharacters in the host_time parameter.'}, {'type': 'list_item', 'content': 'Example command to test injection (replace <auth> and <target> accordingly):'}, {'type': 'list_item', 'content': "curl -u <auth> 'http://<target>/path_to_NTPSyncWithHost?host_time=validtoken;id'"}, {'type': 'paragraph', 'content': "If the system executes the injected command (e.g., 'id'), it indicates the presence of the vulnerability."}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable NTPSyncWithHost handler to trusted users only, as the vulnerability requires authentication.
Avoid passing unsanitized input to shell commands by applying input validation and sanitization on the host_time parameter.
If possible, disable or restrict the /usr/sbin/shttpd service or the specific NTPSyncWithHost functionality until a patch or update is available.
Monitor for unusual command execution or system behavior that could indicate exploitation attempts.