TOTOLINK X2000R CVE-2026-10139

Exploitation requires an authenticated HTTP request to the Mcli functionality of the TOTOLINK X2000R web management interface - i.e., the attacker must already possess valid high-privilege (administrative) credentials, as reflected by PR:H in the CVSS vector. The specific trigger is a crafted HTTP request that overflows a stack buffer in the Mcli handler. Limiting factors that reduce realistic risk: (1) mandatory prior authentication at administrative level, (2) network reachability of the router's management interface, which on default consumer deployments is typically LAN-only rather than WAN-exposed. Risk rises sharply where the admin web UI is exposed to the WAN/internet or where default/reused credentials are in use. Affected build confirmed only for firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.

This is a genuinely high-severity flaw (vendor CVSS 9.1) but with a meaningful exploitation barrier that tempers real-world urgency. The CVSS vector AV:N/AC:L/PR:H/UI:N shows network-reachable, low-complexity exploitation with NO user interaction, but PR:H means the attacker must already hold high (administrative) privileges on the device, and the description confirms exploitation requires an authenticated HTTP request. That authentication requirement is the single most important mitigating signal. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code was referenced - so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The S:C (scope change) and C:H/I:H/A:H in the vendor vector reflect full code execution, consistent with a stack buffer overflow (CWE-121) on embedded router firmware where the web daemon commonly runs as root. Net assessment: a real, patch-worthy vulnerability on affected devices, but the PR:H prerequisite makes it closer to a privilege-abuse / post-authentication RCE than a wormable unauthenticated threat - prioritize for exposed admin interfaces and credential-reuse scenarios rather than as an emergency internet-wide risk. Note the apparent tension to verify: the vector pairs PR:H with S:C, which on an embedded device where the HTTP service and OS share the same (root) security authority is debatable - a scope-unchanged interpretation is equally defensible.

An attacker who has obtained valid administrative credentials (via default/weak passwords, credential stuffing, or a prior auth bypass) sends a specially crafted HTTP request to the Mcli functionality of a TOTOLINK X2000R router, overflowing a stack buffer and executing arbitrary code on the device. Because the router's web daemon typically runs with root privileges, this yields full device takeover enabling traffic interception or botnet enlistment. No public proof-of-concept was referenced in the provided data.