An OS command injection flaw exists in the boa formWsc peerRptPin functionality of the Totolink X2000R router, allowing an attacker who can authenticate with the device to execute arbitrary commands on the host. This can compromise system confidentiality, integrity, and availability by enabling full control over the affected device.

The vulnerability is present in Totolink X2000R routers running the firmware package TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, a model produced by Totolink, and has no other known affected versions listed.

The CVSS score of 9.1 indicates a critical severity, and the EPSS score of 1% indicates a very low but nonzero probability of exploitation. The lack of a KEV listing does not diminish the risk that an adversary can exploit this flaw over a network connection to a device that permits authenticated HTTP requests. The likely attack path requires an adversary to obtain or guess valid credentials, then send a specially crafted HTTP request to the vulnerable endpoint, resulting in remote code execution.