TOTOLINK X2000R CVE-2026-9659

Exploitation requires an authenticated HTTP session to the router's boa web management interface (PR:H - administrative credentials), after which the attacker sends a specially crafted request to the formFilter functionality carrying an oversized vpnUser parameter that overflows a fixed-size stack buffer. Limiting factors: valid admin authentication is mandatory and the management interface must be reachable from the attacker (LAN by default, or WAN only if remote administration is enabled/exposed); it affects the specific firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. No user interaction beyond the attacker's own authenticated request is needed.

This is a genuinely high-severity vulnerability but its real-world priority is tempered by authentication requirements. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) indicates a network-reachable, low-complexity flaw with full confidentiality/integrity/availability impact and a scope change, consistent with stack-based buffer overflow leading to arbitrary code execution. The critical limiting signal is PR:H - exploitation requires an authenticated session (administrative credentials to the router's boa web interface), which meaningfully reduces exposure versus a fully unauthenticated RCE. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this should be treated as a patch-priority issue for exposed TOTOLINK X2000R devices rather than an emergency zero-day. Note a tension between PR:H and the common reality of SOHO routers: default/weak admin credentials and exposed management interfaces can effectively lower the authentication barrier in practice, so the deployed-configuration risk may exceed what PR:H alone suggests - verify management-interface exposure. The S:C (scope change) assignment is also worth scrutiny: on an embedded device where the boa webserver typically runs as root, RCE may be better characterized as same-scope (S:U), which is a reasonable disagreement with the reported vector.

An attacker who has obtained valid administrative credentials to a TOTOLINK X2000R router (via default/weak passwords, credential reuse, or a separate auth bypass) sends a specially crafted HTTP request to the boa formFilter endpoint with an oversized vpnUser parameter. This overflows a fixed-size stack buffer and lets the attacker execute arbitrary code on the device, likely as root given typical embedded webserver privileges. No public exploit code is identified at time of analysis, and the attack requires low complexity once authenticated.