A vulnerability in the Boa Firmware Update feature of the Totolink X2000R allows an attacker who can authenticate with the device to upload a specially crafted firmware binary. Because this update pathway does not verify firmware integrity, the attacker can replace the device’s firmware with a malicious version, effectively taking complete control of the router.

The affected product is the Totolink X2000R, specifically running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. No other vendors or product versions are mentioned in the advisory, indicating this issue is limited to that firmware build.

The CVSS score of 9.1 highlights a severe vulnerability that requires authenticated access. EPSS data are not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits yet. An attacker must have valid HTTP credentials or network access to the router, which indicates an internal or close‑proximity threat scenario. Once authenticated, the attacker can upload arbitrary firmware, dropping a malicious image onto the device and gaining full control.