TOTOLINK X2000R CVE-2026-40627

Exploitation requires an authenticated administrative HTTP session to the device's boa web server (PR:H), after which a crafted request to the formWsc functionality with a malicious targetAPSsid parameter triggers OS command injection on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Limiting factors: valid admin credentials are mandatory (no pre-auth path indicated), the specific vulnerable firmware build must be running, and the management interface must be reachable from the attacker - internet exposure of the WAN-side admin panel greatly increases practical risk, whereas LAN-only exposure confines it to local/adjacent attackers or credential-chaining scenarios.

This is a genuinely high-severity flaw but with an important gating factor. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 9.1) describes network-reachable, low-complexity OS command injection yielding full confidentiality, integrity, and availability impact with a scope change - consistent with command injection in the root-run boa web server of an embedded router. The critical mitigating signal is PR:H: exploitation requires an already-authenticated (administrative) session, which substantially narrows the attacker population versus a pre-auth flaw. No EPSS score was provided and the vulnerability is NOT in CISA KEV, and no public exploit (POC) is indicated in the supplied data, so there is no public exploit identified at time of analysis - this is not evidence of active, widespread exploitation. The dominant real-world risk is chaining: router admin credentials on SOHO/consumer devices are frequently weak, default, or reused, and once valid credentials or an authentication-bypass are obtained, this becomes trivial code execution as root. Treat as a priority to patch for exposed/managed TOTOLINK fleets, but its standalone risk is bounded by the authentication requirement - the 9.1 overstates likelihood for environments with strong admin credential hygiene.

An attacker who has obtained valid administrative credentials to a TOTOLINK X2000R router (via default/weak passwords, credential reuse, or phishing) sends a specially crafted HTTP request to the boa web server's formWsc handler with a malicious value in the targetAPSsid parameter. Because the parameter is passed unsanitized into an OS command, the attacker achieves arbitrary code execution, typically as root on the embedded device. No public exploit code is identified in the provided data, but Talos has documented the vulnerable functionality in detail.