TOTOLINK X2000R CVE-2026-35499

Exploitation requires an authenticated session with high (administrative) privileges on the TOTOLINK X2000R web management interface, after which a crafted HTTP request targeting the boa server's formWsc handler with malicious input in the peerRptPin parameter triggers command injection. Limiting factors: the attacker must first hold admin access (PR:H), and reachability depends on the management interface being accessible to the attacker's network position - WAN-side exposure dramatically increases risk while LAN-only management confines it. No user interaction is required (UI:N), and attack complexity is low (AC:L) once authenticated. The practical barrier is credential acquisition, making weak/default/reused admin passwords or a chained authentication bypass the realistic precondition.

This is a serious but privilege-gated flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) describes a network-reachable, low-complexity OS command injection yielding full confidentiality, integrity, and availability impact, but the PR:H metric and the description's explicit 'authenticated HTTP request' requirement confirm the attacker must already hold high-privilege (administrative) access to the device, which materially lowers real-world urgency versus an unauthenticated RCE. No EPSS score was provided, no POC was supplied, and the CVE is not listed in CISA KEV, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor-assigned S:C (scope change) is debatable for an embedded router where the boa web server typically runs as root and compromise stays within a single security authority; I would assess S:U, which is why my independent score is lower. Bottom line: a high-technical-impact bug that in practice depends on prior admin authentication, so it is a priority mainly where admin credentials are weak, default, shared, or chainable from another auth-bypass flaw, rather than a broadly wormable internet-facing threat.

An attacker who has obtained administrative credentials to the TOTOLINK X2000R web interface (via default/weak credentials, phishing, or a separate auth bypass) sends a crafted HTTP request to the boa server's formWsc endpoint, injecting shell metacharacters into the peerRptPin parameter. The injected command executes with the web server's privileges (typically root on this embedded device), giving full control of the router. No public exploit code is identified at this time, and low attack complexity (AC:L) means a single well-formed request suffices once authenticated.