TOTOLINK X2000R CVE-2026-33568

Exploitation requires an authenticated administrative session on the device's boa HTTP management interface (consistent with PR:H), after which a crafted request to the formMapDelDevice handler with shell metacharacters in the macstr parameter achieves OS command injection. Limiting factors: valid admin credentials are mandatory, and the management interface must be network-reachable by the attacker (typically LAN-side unless WAN management is enabled). No end-user interaction is required. The practical risk amplifier is that SOHO routers often ship with default/guessable credentials, which can lower the effective authentication barrier.

This is a genuinely high-impact flaw (CVSS 9.1) but one meaningfully gated by its prerequisites, so it should be triaged below internet-facing unauthenticated RCEs. The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is internally consistent with the description: network-reachable, low-complexity, no user interaction, but requiring PR:H - i.e. an already-authenticated administrative session on the boa web interface. The exploitation status is 'no public exploit identified at time of analysis' - there is no KEV listing, no POC flag, and no EPSS score in the provided data, so widespread or automated exploitation cannot be asserted; the absence of EPSS means probabilistic exploitation likelihood is simply unknown rather than low. The practical caveat is that consumer/SOHO routers like the TOTOLINK X2000R frequently run with default or weak administrative credentials and sometimes expose management to the WAN, which can erode the PR:H barrier in real deployments - so the authentication requirement limits but does not eliminate risk. SSVC-style read: exploitation=none observed, automatable=no (authentication required), technical impact=total (root-level RCE on the device). Net: a real priority for affected device owners to patch, but not an emergency mass-exploitation scenario on the current evidence.

An attacker who holds or obtains valid administrative credentials for the X2000R web interface (e.g. via default/weak passwords or an exposed WAN management port) sends a crafted HTTP request to the boa server's formMapDelDevice endpoint, injecting shell metacharacters into the macstr parameter. The injected OS command executes on the router, typically with root privileges, giving full device takeover. No public exploit code is identified at time of analysis, though the vulnerability was documented by Cisco Talos.