Improper input validation in Google Chrome's Permissions handling lets a remote attacker who persuades a victim to load a crafted HTML page execute arbitrary code outside the browser sandbox on desktop builds prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects unauthenticated remote reach and a scope change, meaning the impact escapes the browser process boundary, although the Chromium project itself rates the flaw as Medium severity. Google shipped a fix in the 156.0.8078.47 stable channel release; no public exploit code or confirmed active exploitation was identified at time of analysis, so the primary exposure is unpatched desktop users who can be lured into visiting attacker-controlled content.
Improper input validation in Google Chrome's Compositing component before 156.0.8078.47 can let a remote, unauthenticated attacker achieve code execution outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but exploitation depends on user interaction and the vendor describes the code-execution outcome as potential rather than guaranteed. Google has released a fixed build, and no public exploit code has been identified at time of analysis.
Memory corruption in Google Chrome's PerformanceAPIs (all builds prior to 156.0.8078.47) allows remote attackers to potentially execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector scores 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but the signals conflict sharply: Google rates the Chromium severity as Low and qualifies the sandbox escape only as 'potentially' achievable, so reliable code execution beyond the browser sandbox may not be practical. No public exploit was identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
Google Chrome desktop builds before 156.0.8078.47 contain a memory-safety defect in the Permissions code path that can be reached when a victim loads attacker-controlled HTML. Successful exploitation could allow unauthenticated remote attackers to execute code beyond Chrome's sandbox, but the attacker must first convince a user to visit a malicious or compromised page; Google's Medium Chromium severity and the CVSS scope change indicate meaningful impact without evidence of easy or active exploitation. No public exploit identified at time of analysis, and automatic Chrome updates should quickly reduce exposure for most users.
Memory corruption in the Canvas rendering component of Google Chrome prior to 156.0.8078.47 lets a remote attacker potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated over the network but requires user interaction - the victim must navigate to or be lured onto the attacker-controlled page - and, per the scope-change rating, a reliable sandbox escape must also be achieved, which is the real barrier in practice despite the low attack-complexity score. CVSS 3.1 rates this 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) even though Chromium's own severity is Medium; vendor patches are available in Chrome 156.0.8078.47 and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated low-privileged attackers who can reach the OSSL module of Oracle HTTP Server over HTTP can read and modify critical data, with a scope change that lets the impact extend into other Fusion Middleware products reachable through or proxied by the server. The flaw carries a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N; no availability impact) and affects only Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and the front-end position of OHS make this a high-priority patch target.
Authenticated low-privileged attackers with network access to the Fabric Layer component of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 can achieve high confidentiality and integrity impact, including creation, deletion, or modification of critical data and full read access to BPM Suite data, with scope change extending impact to additional Oracle products. The flaw requires a valid account (CVSS PR:L) but no user interaction and low attack complexity, making it easily exploitable once credentials are obtained. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated low-privileged network attackers can exploit Oracle SOA Suite's Fabric Layer to bypass access controls and gain read/write access to critical SOA data, with potential impact spreading to integrated products through scope change. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privilege users can read, create, modify, or delete critical data held in PeopleSoft Enterprise PeopleTools 8.61-8.63 - and, because the CVSS scope is changed, data in connected products as well - by sending crafted requests over HTTP to the SQR component. Exploitation is low-complexity and requires no user interaction, but does require a valid account (PR:L), so exposure is bounded to those who can obtain credentials such as insiders, phished users, or broadly provisioned portal accounts. No public exploit code and no CISA KEV entry were identified at time of analysis; internet-exposed PeopleSoft portals represent the highest realistic risk, and this is a genuine high-priority vulnerability rather than an inflated score.
aaPanel through 8.25.0 derives the client IP in GetClientIp (class/public/common.py) from the attacker-controllable X-Real-Ip request header, allowing remote unauthenticated attackers to spoof their source address and slip past IP-based access restrictions or poison IP-based logging. The impact is bounded - confidentiality-only at low severity per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) - and only materializes where IP allowlisting is actually used as a security boundary and no trusted proxy strips or rewrites the header. Publicly available exploit code exists (a GitHub PoC targeting the X-Real-Ip bypass), and the vendor states the issue has already been fixed.
A crafted AC-4 audio bitstream can crash GPAC's media tools and libraries before release 2.5, giving a local attacker a denial-of-service condition against MP4Box or any GPAC-based application that parses untrusted media. The flaw is an out-of-bounds / memory-safety defect (CWE-119) in gf_ac4_parser_bs() in media_tools/av_parsers.c, where sampling-frequency, frame-rate and substream-group indexes are used without sufficient validation; impact per the assessed CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) is availability-only, with no disclosure or code execution established. It is not listed in CISA KEV, EPSS is low at roughly 0.23% (13th percentile), and a public PoC reference exists but is not verified as working exploit code; no authentication is required, but the attack is local and needs the victim to open or process the malicious file.
Denial of service in GPAC MP4Box before 2.5 occurs when a crafted MP4 file drives the reframer path to a floating-point exception, crashing the process. The issue is local-only (AV:L), requires the victim to open or process the file (UI:R), and affects availability only; environments that ingest untrusted MP4s, such as transcoding or upload pipelines, are the relevant exposure. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV status is indicated, and EPSS is low at 0.20% (9th percentile), so priority is this_month rather than emergency.
Denial of service in GPAC MP4Box before 2.5 occurs when a user locally processes a crafted data file, triggering an out-of-bounds read and process crash in gf_props_equal_internal. The vector is local and requires user interaction; there is no remote or network-facing trigger and no code execution or data disclosure is established by the available data. The issue is moderate and low priority rather than an emergency; a public PoC reference exists, it is not verified as working exploit code, and EPSS is low at 0.20%.
Unauthenticated attackers can forge Embedded Console session tokens against MinIO deployments built up to RELEASE.2025-10-15T17-29-55Z because the globalDeploymentID/SessionTokenAuthenticate path in cmd/common-main.go signs and validates those tokens with a hard-coded cryptographic key. Per the assessed vector (PR:N/UI:N) no credentials or user interaction are required, and the disclosed proof-of-concept demonstrates an unauthenticated admin takeover rather than mere information disclosure. Publicly available exploit code exists (linked from the VulDB entry), no CISA KEV listing is present, and the maintainer states the affected branch is end-of-life, so only unsupported installations with a network-reachable console are exposed.
Froxlor before 2.3.15 allows an authenticated hosting customer with write access to their document root to escalate to root by replacing the statistics directory with a symlink, so the root-run traffic cron's recursive chown follows the link and changes ownership of arbitrary host directories. Exploitation requires a valid customer account, enabled goaccess/webalizer/awstats statistics, and execution of the scheduled traffic cron; no public exploit identified at time of analysis. Vendor-released patch: 2.3.15.
Forged network packets sent to the Advantech ADAM-3600 remote terminal unit (RTU) can trigger arbitrary command execution at maximum (administrative/root) privilege, giving an unauthenticated remote attacker full control of the device. The flaw is rated 9.3 under CVSS 4.0 and corroborated by an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H - no authentication, no user interaction, and no non-default configuration are required, so a single crafted packet against a default-configured unit is sufficient. Exploitation is bounded mainly by network reachability: these RTUs normally sit on segmented OT/SCADA networks, but any unit exposed to the internet or reachable from a compromised IT/DMZ segment is directly at risk. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; CSA Singapore (AL-2026-149) and Advantech have published advisories. This is a genuinely high-priority flaw, not a high-CVSS-but-low-real-risk case.
Authentication bypass in Advantech ADAM-3600 remote terminal units allows unauthenticated network attackers to bypass the proprietary protocol's authentication mechanism and potentially achieve high impact on confidentiality, integrity, and availability (CVSS 9.3; assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is remotely reachable with no credentials or user interaction, but realistic risk depends on whether the device's proprietary protocol service is exposed beyond segmented OT/field networks. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not provided.
Unauthenticated attackers who can reach the HTTP interface of Oracle SOA Suite's Fabric Layer can bypass authentication to read critical data and make limited unauthorized modifications in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw 9.3 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N); the scope change indicates that a successful compromise can reach beyond SOA Suite into other Fusion Middleware components deployed in the same environment. No public exploit code or confirmed active exploitation was identified at time of analysis, but the absence of authentication, user-interaction, or complexity prerequisites makes this a high-priority patch target wherever the SOA HTTP interface is network-reachable.
Authenticated OS command injection in the TOTOLINK X2000R boa web interface lets an attacker with administrative access execute arbitrary code on the router through the formWizard newPass setup-wizard handler. The flaw affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and carries a published CVSS score of 9.1; our assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, with high confidentiality, integrity, and availability impact but unchanged scope. Exploitation requires a valid admin session (PR:H), and no CISA KEV listing, public exploit code, or active exploitation was identified at time of analysis.
Call teardown in Signal's RingRTC media library is unreliable before version 2.72.0: a peer that floods the call's finite-state-machine event channel can prevent a locally initiated hangup from actually tearing down the call, leaving the audio track - and potentially the video track - live after the user believes the call has ended. The attacker must already be an accepted participant in the call (the CVSS 4.0 vector is PR:N, i.e. no privileges required, though call participation is a practical prerequisite) and the victim must actively hang up (UI:P) for the impact to occur, which is why the upstream score of 9.3 is tempered by these preconditions. No public exploit code and no active exploitation have been identified at time of analysis; the realistic threat is a malicious or compromised call peer deliberately saturating the queue so the microphone stays open.
Path traversal (Zip Slip) in FlexGet's optional decompress plugin allows remote attackers to write arbitrary files outside the intended extraction directory by delivering archives containing ../ sequences or absolute member paths through a feed. Affected are FlexGet releases before 3.20.7 that have the decompress plugin configured; an attacker who can supply or poison a feed consumed by the target can drop Python files into FlexGet's plugins directory, achieving code execution with the privileges of the FlexGet process. A vendor fix exists in 3.20.7 (commit 38fa748) adding a resolved-path containment check and a PathTraversalError class, and the public commit diff plus regression tests effectively document the exploitation technique; no public exploit was identified at time of analysis and there is no KEV confirmation of active exploitation.
Oracle Agile Product Lifecycle Management for Process 6.2.4 contains a remotely reachable, unauthenticated weakness that lets an attacker who first persuades a legitimate user to open a crafted link or view attacker-controlled content gain unauthorized creation, deletion, and modification of critical PLM data alongside full read access to it, with impact potentially extending into connected products because the CVSS scope is changed (base 9.3). The attacker cannot complete the chain alone - the vector requires that second user's interaction (UI:R), and availability is unaffected (A:N) - so exposure is concentrated in internet- or intranet-reachable 6.2.4 deployments whose users can be socially engineered. No public exploit code was identified and the issue is not confirmed actively exploited (not in CISA KEV) at the time of analysis, so the 9.3 severity reflects theoretical impact rather than observed attacks.
Unauthenticated remote attackers can exploit an authentication bypass in the Security component of Oracle Essbase 21.8.3.0.0 over HTTP, gaining unauthorized access to critical data and limited ability to modify it, with potential impact extending to connected Oracle products due to a scope change. The vulnerability carries a CVSS 9.3 base score; no public exploit identified at time of analysis, and no CISA KEV entry confirms active exploitation. Risk is highest for instances with internet-facing or otherwise network-reachable Essbase HTTP services, while segmented or access-restricted deployments are less exposed.
Unauthenticated information disclosure in the Easy Property Listings WordPress plugin before 3.5.28 causes listing fields that site owners intentionally hide from the public front end - asking price, sold price, street address and exact map coordinates - to still be returned in the plugin's public REST API output. Any remote visitor can query that REST output without credentials or user interaction and read values the site chose to suppress, though only the configured-as-hidden fields of published listings are exposed; there is no write, authentication-bypass or code-execution impact. Publicly available exploit code exists and the WPScan team is credited with the report, but EPSS is low at 0.18% (8th percentile) and there is no CISA KEV confirmation of active exploitation, so this is a low-to-moderate priority issue principally relevant to sites that deliberately conceal price or address data.
Authenticated OS command injection in the boa web management interface of the TOTOLINK X2000R router allows anyone holding administrative credentials to run arbitrary commands on the device by sending a crafted HTTP request to the formPasswordSetup endpoint. Only units running firmware V1.0.0-B20250421.1327 are affected, and the CVSS vector (PR:H) confirms the flaw sits behind a high-privileged login, so it is an access-gated post-authentication escalation to full device compromise rather than a pre-auth router takeover. No public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV; the real-world risk comes from internet-exposed management interfaces and from default or reused admin passwords.
OS command injection in the batchupg (batch upgrade) handler of TOTOLINK X2000R firmware build V1.0.0-B20250421.1327 lets an attacker who already holds a valid administrator session on the router's web management interface send a crafted HTTP request that executes arbitrary shell commands on the device, yielding a full compromise of confidentiality, integrity, and availability. The prerequisite of high-privileged web credentials (CVSS PR:H) sharply limits exposure - this is not reachable by an unauthenticated attacker - but the practical risk climbs sharply on units whose admin panel is exposed to the WAN or still uses default/weak credentials. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the flaw was reported by Cisco Talos under TALOS-2026-2435.
Authenticated OS command injection in the boa web management interface of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an attacker holding a valid administrative session to send a crafted HTTP request to the formUpload() handler and have unsanitized input executed as a shell command, yielding arbitrary code execution on the device. Reported by Cisco Talos (TALOS-2026-2438) with a high severity score; exploitation requires PR:H admin privileges and network reachability to the management HTTP interface, so exposure is greatest where the admin UI is reachable from the WAN or default/weak credentials are in use. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no vendor-released fix version is referenced in the available data.
Authenticated command injection in TOTOLINK X2000R is a serious but privilege-gated flaw: an attacker who already holds administrative access to the router's web management interface can send a crafted HTTP request to the Boa formWsc handler and execute arbitrary OS commands via the peerRptPin parameter. The affected build is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, and exploitation requires high privileges (PR:H) but no user interaction and low attack complexity once admin access is obtained. No public exploit was identified at time of analysis, and the practical barrier is credential acquisition, such as weak, default, or reused admin passwords or a chained authentication bypass.
Authenticated OS command injection in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows an administrator-level attacker to execute arbitrary shell commands by sending a crafted HTTP request to the boa formWsc handler with a malicious targetAPSsid value. The issue is rated CVSS 9.1 and requires a valid high-privileged administrative session (PR:H); no public exploit code or CISA KEV entry was identified at time of analysis, so practical risk depends heavily on whether the router management interface is exposed.
Authenticated OS command injection in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows a high-privileged administrative user to execute arbitrary OS commands by sending a crafted HTTP request to the boa formMapDelDevice handler with shell metacharacters in the macstr parameter (CVSS 9.1). Exploitation requires a valid administrative session and network reachability to the management interface, typically LAN-side unless WAN management is enabled; no public exploit code was identified at time of analysis.
An authorization bypass (IDOR) in EspoCRM's PDF rendering pipeline lets an authenticated low-privilege user read attachments they should not be able to access by supplying an arbitrary attachment ID as the image source of a PDF template. Affected versions are EspoCRM up to 9.3.10 and 10.0.10; the flaw resides in ImageSourceProvider::get (application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php) and is reached simply by rendering a template to PDF. Impact is limited to confidentiality of attachment data (CVSS 5.3, PR:L, no victim interaction), publicly available exploit code exists, and there is no indication of active exploitation in the wild.
Arbitrary shell command execution in Apache CouchDB 3.5.2 and earlier on all platforms allows an authenticated CouchDB server administrator to run commands as the CouchDB operating-system user by setting an unvalidated runtime configuration value. The flaw crosses from application administration into host command execution, so the main risk is privilege escalation from CouchDB admin to the underlying host or misuse of stolen admin credentials; exploitation requires high-privilege authentication (PR:H) and is not remote-unauthenticated. Vendor-released patch: 3.5.3; no public exploit identified at time of analysis.
Out-of-bounds write in Eclipse NetX Duo's X.509 certificate-chain verification lets unauthenticated remote attackers corrupt static memory by presenting a certificate with an RSA modulus larger than the 4096-bit NX_CRYPTO_MAX_RSA_MODULUS_SIZE buffer dimension. The flaw is reachable pre-authentication on TLS/DTLS clients validating a malicious server chain and on servers configured for client-certificate authentication, because the peer-supplied issuer is resolved before the trusted store. No public exploit was identified at time of analysis, but the issue is rated critical (CVSS 4.0 9.3; independently assessed CVSS 3.1 9.8).
Missing authorization in Unblu Spark's Collaboration Server (versions 7.0 through 8.36.1-hotfix.0) lets any authenticated low-privilege user read and modify configuration data belonging to other users and accounts - and, in Unblu Cloud, other customers' tenants - crossing a security boundary. The server omits ownership checks on configuration-cascade operations, and when non-default configuration validation settings are in effect a registered user can also write configuration properties outside their permitted scope; exploitation needs a valid session but no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, but the cross-tenant read/write impact and critical severity (CVSS 4.0 9.3; the independent CVSS 3.1 assessment is also critical) make this a high-priority fix.
Authenticated path traversal in the boa formUploadFile handler of TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows an attacker with valid web-management credentials to write arbitrary files and potentially achieve code execution. The issue is high severity but gated by mandatory authentication to the router's HTTP administration interface, so realistic risk is concentrated on devices with exposed admin access or weak/default credentials. No public exploit was identified at time of analysis, and no CISA KEV active-exploitation confirmation is available.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router's boa formIpQos handler lets an attacker with administrator credentials send a crafted HTTP request containing a malicious 'mac' parameter to overwrite a stack buffer and achieve arbitrary code execution. The flaw affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and requires a valid high-privilege management session plus reachability of the boa web interface. No public exploit code or confirmed active exploitation has been identified at time of analysis, and practical risk is concentrated where default or weak admin credentials and WAN-exposed management interfaces are present.
Authenticated administrative users of TOTOLINK X2000R firmware build B20250421.1327 can trigger a stack-based buffer overflow through crafted HTTP requests to the batchupg endpoint, potentially achieving arbitrary code execution. The CVSS vector requires high privileges (PR:H), meaning valid admin credentials are the primary prerequisite, and reachability depends on the management interface being accessible to the attacker. No public exploit code was identified at time of analysis, and no pre-authentication exploitation path is indicated.
Authenticated attackers can trigger a heap-based buffer overflow in the boa web server's formUpload() handler on TOTOLINK X2000R routers running firmware V1.0.0-B20250421.1327, potentially leading to arbitrary code execution. The vulnerability requires valid administrative credentials (PR:H) but no user interaction, and the management interface must be network-reachable. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated attackers who can reach the boa web administration interface on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 can trigger a stack-based buffer overflow by sending a crafted HTTP request to formUpload(), with potential for arbitrary code execution and high confidentiality, integrity, and availability impact. The issue is access-gated: exploitation requires high-privilege router administrator credentials (PR:H) and low complexity once authenticated (AC:L/UI:N), so realistic risk depends on whether the management UI is exposed and protected by default or weak credentials. No public exploit code or CISA KEV active-exploitation listing was identified in the provided data.
A stack-based buffer overflow in the Mcli handler of the TOTOLINK X2000R router's web management interface lets an attacker who supplies a specially crafted HTTP request overwrite stack memory and potentially achieve arbitrary code execution on the device. Only firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 has been confirmed affected, and exploitation requires valid administrative credentials (PR:H in the CVSS vector), so the practical attack path is an authenticated one against an exposed management interface. Vendor severity is rated 9.1 and the flaw was reported by Cisco Talos as TALOS-2026-2439; no public exploit code or confirmed active exploitation was identified at time of analysis, though risk rises sharply on deployments where the admin UI is reachable from the WAN or protected by default/reused credentials.
Authentication bypass in Advantech ADAM-3600 enables unauthenticated network attackers to abuse the password-reset mechanism and gain unauthorized access, with high confidentiality, integrity, and availability impact; CVSS 4.0 scores this 9.2, while our independent CVSS 3.1 assessment rates it high with AC:H because a specific precondition in the reset flow must be met (AT:P). No public exploit code has been identified at time of analysis, and exploitation depends on network reachability to the controller's management/reset interface; OT segmentation substantially reduces exposure. This is a high priority for affected ICS/OT environments where ADAM-3600 devices are internet-facing or reachable from compromised IT segments.
Unauthenticated remote code execution is possible against the Advantech ADAM-3600 through a stack-based buffer overflow in its login handling. The device is rated Critical (vendor CVSS 4.0 score 9.2; assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), but reliable exploitation is constrained by high attack complexity and by whether the login service is reachable from untrusted networks. No public exploit was identified at time of analysis.
Authenticated administrator-level attackers can achieve arbitrary code execution on Totolink X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 by sending a crafted HTTP request with an overlong static_gw parameter to the boa formIpv6Setup static network configuration endpoint. The stack-based buffer overflow (CWE-121) requires a valid admin session (CVSS PR:H), so exposure of the web management interface and weak or default credential hygiene are the practical enablers. This is a high-severity issue, but no public exploit was identified at time of analysis, and other firmware or hardware revisions are not confirmed affected from the available data.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, where an oversized static_ipv6 parameter sent to the boa formIpv6Setup handler overflows a stack buffer and can lead to arbitrary code execution. Exploitation requires valid administrative credentials on the router's web management interface (CVSS PR:H), which is typically reachable only from the LAN unless remote administration is enabled; default or weak admin passwords on consumer routers reduce that barrier. No public exploit code was identified at time of analysis.
Stack-based buffer overflow in the TOTOLINK X2000R router's boa web management server allows an authenticated administrator to achieve arbitrary code execution by sending a crafted HTTP request to the formIpv6Setup endpoint carrying an oversized dhcp_dns2 parameter. Only firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed affected, and the attack requires a valid high-privilege session (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N) on the device's web interface, meaning real-world exploitation generally depends on default-credential reuse or chaining with a separate authentication bypass. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released fix is confirmed in the available data.
Arbitrary code execution in the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) requires an attacker to first authenticate to the boa administrative web interface, then send a crafted HTTP request whose dhcp_dns1 parameter overflows a fixed-size stack buffer in the formIpv6Setup handler. Successful exploitation corrupts stack memory and can redirect execution to attacker-controlled data, giving code execution on the device with the web server's privileges. The CVSS vector (PR:H) and the Talos report both confirm that valid high-privilege admin credentials are a hard prerequisite, so the practical threat is concentrated on devices whose management interface is exposed to untrusted networks or left on default/weak credentials; no public exploit code or active exploitation was identified at time of analysis.
Stack-based buffer overflow in TOTOLINK X2000R router firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows a high-privileged authenticated management user to trigger arbitrary code execution by sending a crafted HTTP request to the boa formFilter endpoint with an oversized vpnPassword parameter. The CVSS vector confirms network reachability, low attack complexity, high privileges required, and no user interaction; risk is concentrated on devices with exposed web administration and weak or default admin credentials. No public exploit was identified at time of analysis.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, where the boa web management interface's formFilter handler processes the vpnUser HTTP parameter into a fixed-size stack buffer without adequate bounds checking. An attacker who first obtains administrative credentials (PR:H) can send an oversized vpnUser value to overflow the stack and potentially execute arbitrary code; exposure is limited by the need for valid admin authentication and reachability of the management interface. The authoritative assessment uses CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and no public exploit identified at time of analysis.
Authenticated stack-based buffer overflow in the boa formUploadFile handler on TOTOLINK X2000R routers can allow arbitrary code execution when a specially crafted HTTP request is sent to the web management interface. The issue affects the specific firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and requires administrative credentials (PR:H) plus network reachability to the management UI, which is normally LAN-restricted. No public exploit has been identified at time of analysis, and the vendor/Talos CVSS is 9.1.
Stack-based buffer overflow in the boa web server's formTR069Config handler on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 lets an authenticated attacker send a specially crafted HTTP request that overflows a fixed-size stack buffer and can lead to arbitrary code execution on the router. The flaw is network-reachable with low attack complexity, but exploitation requires valid management credentials (CVSS PR:H), making exposure of the administrative interface and credential hygiene the decisive risk factors. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 9.1 CRITICAL base score reflects full confidentiality, integrity and availability impact once the authentication barrier is crossed.