An OS command injection flaw exists in the boa formMapDelDevice macstr handler of the X2000R router. A specially crafted HTTP request sent to the device allows an authenticated attacker to inject arbitrary shell commands. Exploitation yields full code execution on the device, compromising confidentiality, integrity, and availability of the router and any connected network assets. The weakness is a classic command injection (CWE‑78).

The affected device is the TOTOLINK X2000R router, model identifier TOTOLINK‑X2000R‑Gh‑V1.0.0‑B20250421.1327. No other product or version information is listed for this vulnerability.

The CVSS score of 9.1 marks this vulnerability as critical. The EPSS score of 1% indicates a very low but nonzero likelihood of exploitation in the wild, but the lack of KEV listing indicates no known active exploits at the time of this report. The flaw requires authenticated access, so the most likely attack scenario involves a malicious insider or an attacker who has compromised valid administrative credentials, or an external attacker who has bypassed authentication controls. Once authenticated, the attacker can trigger the injection and achieve remote code execution.