Description
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Published: 2026-10-20
Score: 9.1 Critical
EPSS: 1.6% Low
KEV: No
Impact: Remote Code Execution
Action: Assess Impact
AI Analysis

Impact

An OS command injection flaw exists in the boa formWizard newPass functionality of the TOTOLINK X2000R device. A specially crafted HTTP request can cause the device to execute arbitrary commands on the underlying operating system. The vulnerability is triggered when an attacker sends an authenticated request, enabling complete compromise of the device’s confidentiality, integrity, and availability.

Affected Systems

The affected product is TOTOLINK X2000R (model X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). Only this specific build contains the vulnerable Boa formWizard endpoint.

Risk and Exploitability

The CVSS score of 9.1 indicates a severe risk. EPSS score is 1%, and the vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires authenticated access to the device’s web interface; once achieved, the attacker can execute arbitrary commands with the privileges of the web application, potentially taking full control of the router.

Generated by OpenCVE AI on October 22, 2026 at 19:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Configure a web application firewall to filter or block requests that match command injection patterns against the boa formWizard endpoint.
  • Restrict or disable the newPass functionality for non‑trusted users by tightening authentication requirements or removing the endpoint from public access.
  • Obtain and install any newer firmware or vendor‑supplied patch that eliminates the vulnerable code when it becomes available.

Generated by OpenCVE AI on October 22, 2026 at 19:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection in X2000R boa formWizard newPass

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink x2000r
Vendors & Products Totolink
Totolink x2000r

Tue, 20 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Totolink X2000r
cve-icon MITRE

Status: PUBLISHED

Assigner: talos

Published:

Updated: 2026-10-23T22:09:29.905Z

Reserved: 2026-05-28T09:27:31.693Z

Link: CVE-2026-9814

cve-icon Vulnrichment

Updated: 2026-10-23T20:45:17.260Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T21:17:22.773

Modified: 2026-10-23T23:19:50.850

Link: CVE-2026-9814

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T20:00:12Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')