An OS command injection flaw exists in the boa formWsc targetAPSsid functionality of the Totolink X2000R firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An attacker can craft a special HTTP request that, when sent to an authenticated session, allows arbitrary command execution on the router. The vulnerability is a classic CWE‑78 type error where input is not properly sanitized before being passed to the system shell. If an attacker succeeds, they can fully compromise the device, gain privileged control, and potentially pivot to other network assets.

The flaw affects the Totolink X2000R router running firmware version TOTOLINK‑X2000R‑Gh‑V1.0.0‑B20250421.1327. No other versions or models were identified in the advisory.

The vulnerability carries a CVSS base score of 9.1, indicating high severity. The EPSS score is 1%, indicating a low but nonzero probability that this vulnerability will be exploited. It is not listed in the CISA KEV catalog, but the nature of the flaw – requiring authenticated access – means the risk is significant for environments that expose the router’s management interface over the network or use weak default credentials. Exploitation would likely involve an attacker who has obtained or guessed valid router credentials or is able to exploit the management interface from an internal network. At the time of analysis, no vendor‑issued exploit was publicly documented, but the combination of a high severity score and the ability to achieve remote code execution warrants urgent remediation.