An arbitrary file write vulnerability exists in the boa formUploadFile functionality of the Totolink X2000R. A specially crafted HTTP request sent by an attacker who has authenticated access can write arbitrary files, enabling the execution of malicious code on the device. The flaw directly leads to full code execution on the affected router, compromising confidentiality, integrity, and availability.

The vulnerable systems are Totolink X2000R routers running firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Only this specific build is known to be affected; no other Totolink product variants or versions are listed.

The CVSS score of 9.1 classifies the vulnerability as critical, indicating a highly destructive exploit if applied. Because the EPSS score is not available, the current exploitation probability cannot be quantified, but the absence of a KEV listing suggests no publicly known exploits have yet been confirmed. The likely attack vector involves an authenticated HTTP request to the form upload endpoint; an attacker must obtain valid credentials to trigger the flaw.