TOTOLINK X2000R CVE-2026-9660

Exploitation requires an authenticated HTTP request to the boa web server's formFilter functionality on a TOTOLINK X2000R running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, with an attacker-controlled oversized value supplied in the vpnPassword parameter. The primary limiting factor is authentication (PR:H): the attacker must already possess valid management credentials, so exposure depends on whether the web management interface is reachable by the attacker and whether default/weak admin credentials are in use. No special non-default feature toggle is indicated beyond access to the VPN configuration form; no user interaction is required (UI:N).

This is a genuine high-severity vulnerability but its real-world priority is tempered by a significant precondition. The vendor CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects network-reachable, low-complexity exploitation with full CIA impact and a scope change, consistent with arbitrary code execution in the boa web server. However, the vector itself (PR:H) and the description both confirm the attacker must already hold authenticated access to the device management interface, which substantially lowers the unauthenticated-internet-worm risk that the 9.1 score might superficially suggest. No EPSS score, KEV listing, SSVC decision data, or public POC were provided in the input, so exploitation probability cannot be quantified from these signals - exploitation status is therefore 'no public exploit identified at time of analysis.' The finding originates from Cisco Talos (TALOS-2026-2425), a credible research source, which raises confidence that the technical issue is real and that coordinated disclosure (and likely a POC held privately by the researcher) exists even if not yet public. Net assessment: a real priority for anyone exposing a TOTOLINK X2000R management interface, especially where default or weak admin credentials make the PR:H barrier trivial to clear, but not an indiscriminate mass-exploitation threat today given the authentication requirement and absence of KEV/EPSS corroboration.

An attacker who has obtained valid management credentials (e.g., via default passwords, credential reuse, or a chained auth-bypass) sends a crafted HTTP request to the boa web server's formFilter endpoint with an oversized vpnPassword value, overflowing a stack buffer. This overwrites the return address and leads to arbitrary code execution on the router, typically as root. No public exploit code was identified at time of analysis, though the Talos report implies a working proof-of-concept exists privately.