PatchTheCVE: a6000r firmwarehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-3249: A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000https://patchthecve.com/cve/CVE-2025-3249.htmlhttps://patchthecve.com/cve/CVE-2025-3249.htmlWed, 17 Jun 2026 09:19:30 +0000MEDIUM 6.3: A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploiCVE-2024-57214: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devnhttps://patchthecve.com/cve/CVE-2024-57214.htmlhttps://patchthecve.com/cve/CVE-2024-57214.htmlWed, 17 Jun 2026 08:13:23 +0000MEDIUM 6.3: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.CVE-2024-57213: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newphttps://patchthecve.com/cve/CVE-2024-57213.htmlhttps://patchthecve.com/cve/CVE-2024-57213.htmlWed, 17 Jun 2026 08:13:23 +0000MEDIUM 6.3: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the action_passwd function.CVE-2024-57212: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmohttps://patchthecve.com/cve/CVE-2024-57212.htmlhttps://patchthecve.com/cve/CVE-2024-57212.htmlWed, 17 Jun 2026 08:13:22 +0000MEDIUM 5.1: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the action_reboot function.CVE-2024-57211: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modihttps://patchthecve.com/cve/CVE-2024-57211.htmlhttps://patchthecve.com/cve/CVE-2024-57211.htmlWed, 17 Jun 2026 08:13:22 +0000HIGH 8.0: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_wsh function.CVE-2024-41319: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd https://patchthecve.com/cve/CVE-2024-41319.htmlhttps://patchthecve.com/cve/CVE-2024-41319.htmlWed, 17 Jun 2026 07:47:34 +0000CRITICAL 9.8: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function.CVE-2024-41320: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifnahttps://patchthecve.com/cve/CVE-2024-41320.htmlhttps://patchthecve.com/cve/CVE-2024-41320.htmlWed, 17 Jun 2026 07:47:35 +0000HIGH 8.8: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the get_apcli_conn_info function.CVE-2024-41318: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifnahttps://patchthecve.com/cve/CVE-2024-41318.htmlhttps://patchthecve.com/cve/CVE-2024-41318.htmlWed, 17 Jun 2026 07:47:34 +0000CRITICAL 9.8: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function.CVE-2024-41317: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifnahttps://patchthecve.com/cve/CVE-2024-41317.htmlhttps://patchthecve.com/cve/CVE-2024-41317.htmlWed, 17 Jun 2026 07:47:34 +0000HIGH 8.0: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.CVE-2024-41316: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifnahttps://patchthecve.com/cve/CVE-2024-41316.htmlhttps://patchthecve.com/cve/CVE-2024-41316.htmlWed, 17 Jun 2026 07:47:34 +0000CRITICAL 9.8: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.CVE-2024-41315: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifnahttps://patchthecve.com/cve/CVE-2024-41315.htmlhttps://patchthecve.com/cve/CVE-2024-41315.htmlWed, 17 Jun 2026 07:47:34 +0000MEDIUM 6.8: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.CVE-2024-41314: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifachttps://patchthecve.com/cve/CVE-2024-41314.htmlhttps://patchthecve.com/cve/CVE-2024-41314.htmlWed, 17 Jun 2026 07:47:34 +0000MEDIUM 6.8: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.CVE-2024-37626: A command injection issue in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware allows a remote attacker to executhttps://patchthecve.com/cve/CVE-2024-37626.htmlhttps://patchthecve.com/cve/CVE-2024-37626.htmlThu, 09 Jul 2026 01:19:04 +0000HIGH 8.8: A command injection issue in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware allows a remote attacker to execute arbitrary code via the iface parameter in the vif_enable function.