A vulnerability in the boa formUpload() feature of TOTOLINK X2000R allows an attacker to inject operating‑system commands by sending a specially crafted HTTP request. This is a CWE‑78 Command Injection flaw. The injection can be triggered only when the attacker is authenticated, meaning the attacker must possess valid credentials to the device. Successful exploitation would enable the attacker to execute arbitrary code with the privileges of the web service, potentially leading to full device compromise.

The affected product is the TOTOLINK X2000R router, firmware builds identified as TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. No other products or versions are listed in the current data. Users of this firmware need to verify whether their device is running this specific build.

The CVSS score of 9.1 classifies this flaw as critical and the EPSS score is 1.15%, indicating a low exploitation probability. It is also not listed in the CISA KEV catalog. The vulnerability can be exploited via an authenticated HTTP request, so only users who can log in to the router’s web interface pose a risk. Because the attacker could run arbitrary system commands, the potential impact spans confidentiality, integrity, and availability of the device and any networks it connects to.