TOTOLINK X2000R CVE-2026-10131

Exploitation requires a valid authenticated session to the TOTOLINK X2000R web management interface (boa HTTP server) - specifically reachable access to the formPasswordSetup functionality, which for a password-setup feature implies administrative-level credentials (consistent with CVSS PR:H). The attacker crafts an HTTP request injecting OS commands into a parameter of that endpoint. Key limiting factors: the device must be running the affected firmware build (V1.0.0-B20250421.1327), the attacker must already possess working credentials, and the management interface must be network-reachable from the attacker (LAN by default, or WAN only if remote administration is exposed). No user interaction is required once authenticated.

This is a serious but access-gated vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C) rates it 9.1 Critical, driven largely by the network attack vector, low complexity, no user interaction, and a scope change with full C/I/A impact. The single most important mitigating signal is PR:H: the Talos report explicitly states the attacker must make an AUTHENTICATED HTTP request, so a valid (and for a password-setup endpoint, almost certainly administrative) credential is a hard prerequisite. That materially reduces real-world risk versus a pre-auth RCE. No EPSS score, KEV listing, or POC/exploit code was provided in the input, so there is no evidence of active or imminent mass exploitation at the time of analysis. The high CVSS is therefore largely a product of the impact metrics rather than ease of opportunistic exploitation. NOTE a tension worth flagging: Talos assigned Scope:Changed (S:C), which inflates the score, but OS command injection in the boa web server of a SOHO router typically executes within the same security authority (the web server frequently already runs as root on these devices), which would argue for S:U - verify scope rationale with the vendor/Talos. Net: a real patch-worthy issue for exposed or multi-tenant TOTOLINK X2000R deployments, but not a drop-everything internet-wide emergency given the authentication requirement and absence of exploitation signals.

An attacker who already holds valid (likely admin) credentials to a TOTOLINK X2000R router - obtained via default/weak passwords, credential reuse, phishing, or an exposed management interface - sends a specially crafted HTTP request to the boa server's formPasswordSetup handler, injecting OS commands into an unsanitized parameter. The injected commands run on the device, yielding arbitrary code execution (commonly as root on such embedded devices) and full control of the router. No public exploit code was identified in the provided data, so exploitation currently requires independent development from the Talos report.