Totolink - X6000r - CRITICAL - CVE-2026-105484. A security vulnerability has been identified in the TOTOLINK X6000R router firmware version 9.4.0cu.652_B20230116. The flaw exists within the UploadFirmwareFile Handler of the firmware_check function located in /cgi-bin/cstecgi.cgi. By manipulating the file_name argument, an attacker can perform remote OS command injection, potentially compromising the underlying operating system. This vulnerability underscores the importance of securing router firmware against unauthorized access and command execution.