TOTOLINK X2000R CVE-2026-10132

Exploitation requires an authenticated, high-privilege (administrator) session on the router's boa HTTP management interface, which the attacker uses to send a crafted request to the formIpQos handler carrying a malicious 'mac' parameter that overflows a stack buffer. Limiting factors: valid admin credentials are mandatory (CVSS PR:H), the specific affected firmware build (X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) must be present, and the management interface must be reachable by the attacker - real-world impact is largely gated by whether admin access is weakly protected (default credentials) or whether the web UI is exposed to the WAN.

Signals are mixed and point to a moderate, not top-tier, real-world priority. The CVSS base score of 9.1 is inflated primarily by the Scope:Changed metric; the vector itself (AV:N/AC:L/PR:H/UI:N) makes clear that exploitation requires HIGH privileges - i.e., an already-authenticated administrative session on the router's web interface - which substantially limits opportunistic mass exploitation. There is no EPSS score provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The finding originates from Cisco Talos (TALOS-2026-2433), a high-quality source, so the technical vulnerability itself is credible and confirmed by a reputable researcher, but there is no evidence of in-the-wild activity. The practical risk is highest where these consumer/SOHO routers expose their management interface and use default or weak admin credentials, turning the PR:H barrier into a low hurdle. Note the discrepancy: the vector asserts S:C (scope change) which drives the critical score, yet a stack overflow in the boa web server typically yields code execution within that same device authority - verify scope justification with the vendor/Talos advisory, as S:U would reduce this to High (~7.2).

An attacker who has obtained valid administrative credentials to a TOTOLINK X2000R router (via default passwords, credential reuse, or a prior auth bypass) sends a specially crafted HTTP request to the boa server's formIpQos endpoint with an oversized/malformed 'mac' parameter. This overflows a stack buffer (CWE-121), overwriting the return address and leading to arbitrary code execution on the device, typically as root. No public exploit code is currently referenced, so weaponization would require independent development from the Talos advisory details.