An OS command injection flaw exists in the boa formPasswordSetup endpoint of Totolink X2000R. By sending a specially crafted HTTP request that includes malicious shell commands, an attacker who can authenticate to the device can trigger arbitrary execution of system commands. This flaw enables the attacker to execute arbitrary commands on the router’s operating system, potentially compromising the device’s confidentiality, integrity, or availability.

The affected equipment is the Totolink X2000R router, specifically firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. No other versions or products were identified as vulnerable in the CNA report. Users operating this firmware revision should verify their device's build number and assess whether they are using the impacted revision.

The CVSS score of 9.1 places this flaw in the critical severity range, indicating that exploitation could have catastrophic results. The EPSS score of 1% indicates a low probability of exploitation, although the lack of listing in the CISA KEV catalog does not diminish the seriousness of the issue. The likely attack vector requires an authenticated HTTP session, meaning that the attacker needs to log in or otherwise obtain valid credentials. Once authenticated, the attacker can directly send a request to the vulnerable endpoint and trigger command execution with the privileges of the router's operating system.