TOTOLINK X2000R CVE-2026-10137

Requires valid authenticated access to the X2000R device's boa-based web administration interface (PR:H), from which the attacker sends a crafted HTTP request to the formUpload() functionality to trigger the stack overflow. No user interaction is needed (UI:N) and complexity is low (AC:L) once authenticated. The primary limiting factor is credential access: exploitation is gated behind router admin login, so realistic risk hinges on whether the device uses default/weak credentials or is reachable from an attacker-controlled network segment. Confirmed affected firmware is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; applicability to other versions is not stated.

This is a high-severity but access-gated vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 9.1) indicates a network-reachable, low-complexity flaw with full confidentiality, integrity, and availability impact - but critically it requires PR:H, and the Talos description explicitly confirms 'an authenticated HTTP request' is needed. This single prerequisite substantially lowers real-world risk versus a true unauthenticated RCE, since an attacker must already hold valid credentials (or chain a separate auth bypass / use default/weak router passwords). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or mass scanning at this time. One notable conflict: the input vector asserts S:C (scope changed), yet a stack overflow in the boa web server typically yields code execution within that same (already highly privileged, usually root) component without crossing a security authority boundary - the scope-changed rating may be inflated. Overall this is a credible high-impact router RCE suitable for prioritized patching on exposed/managed TOTOLINK fleets, but the authentication requirement makes it a targeted-abuse or post-credential-compromise issue rather than an internet-wide wormable threat.

An attacker who has obtained valid credentials for a TOTOLINK X2000R admin interface (via default/weak passwords, phishing, or reuse) sends a specially crafted HTTP request to the boa web server's formUpload() handler, overflowing a stack buffer and gaining arbitrary code execution - typically as root - on the router. No public exploit code is identified at time of analysis, though a detailed Talos vulnerability report exists. Because the CVSS vector is AV:N/AC:L with no user interaction, the request itself is trivial to deliver once authenticated.