The flaw is an OS command injection in the batchupg functionality of the TOTOLINK X2000R device. A specially crafted HTTP request can inject arbitrary commands, which the device will execute with the privileges of the web service process. The impact is the ability for an attacker to run any code on the device, potentially leading to full takeover and the ability to pivot into connected networks.

Affected are devices manufactured by Totolink, specifically the X2000R model running firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. No other products or versions are indicated as vulnerable by the vendor documentation.

The entry carries a CVSS score of 9.1, indicating a high severity flaw. The EPSS score of 1% highlights a low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is an authenticated HTTP request; an attacker must possess valid credentials to trigger the injection. Once authenticated, the attacker could inject arbitrary code and achieve full control of the device. Given the high impact score and lack of mitigation information, administrators should treat this as a critical risk pending a vendor update.