TOTOLINK X2000R CVE-2026-10138

Exploitation requires an authenticated administrative session on the router's boa web server (CVSS PR:H) and the ability to reach the device's management HTTP interface over the network (AV:N). The specific trigger is a crafted HTTP request to the formUpload() functionality, where attacker-controlled input is passed unsanitized into an OS command (CWE-78). Limiting factors: the attacker must first hold valid admin credentials (or defeat authentication by another means), and the affected firmware build (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) must be deployed with its management interface reachable; exposure is substantially higher when the admin UI is reachable from the WAN or when default/weak credentials are in use. No special non-default feature toggle is named in the advisory beyond the formUpload handler itself.

This is a high-severity but privilege-gated issue rather than a drop-everything emergency. The CVSS 3.1 base score of 9.1 is driven by network attack vector (AV:N), low complexity (AC:L), no user interaction (UI:N), a changed scope (S:C), and full C/I/A impact - but it critically requires high privileges (PR:H), meaning the attacker must already hold authenticated administrative access to the device's web interface before exploitation. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the source data, so there is no signal of active exploitation or widespread automated attack at this time (no public exploit identified at time of analysis). The practical risk is therefore concentrated in scenarios where admin credentials are weak, default, reused, or already compromised - or where the attacker is an insider - since authentication is the primary barrier. Note a signal tension worth verifying: the S:C (scope-changed) rating is debatable for an on-device OS command injection where the boa HTTP daemon and the injected command typically execute within the same device context; if Talos intended scope-unchanged, the base score would drop. The absence of EPSS/KEV/POC data does not confirm the vulnerability is unexploited - it reflects missing enrichment, not verified safety.

An attacker who has obtained administrative access to a TOTOLINK X2000R router's web interface (via default/weak credentials, credential reuse, or a prior auth bypass) sends a specially crafted HTTP request to the boa server's formUpload() handler. Injected shell metacharacters in the request are passed to an OS command, yielding arbitrary code execution - typically as root given embedded-device httpd privileges. No public exploit code was identified in the provided data, but the vulnerability was reported by Cisco Talos with a detailed advisory.