TOTOLINK X2000R CVE-2026-9817

Exploitation requires authenticated access to the TOTOLINK X2000R boa web management interface (PR:H indicates administrative-level credentials) and the ability to reach the formUploadFile endpoint over HTTP - typically the LAN-side or, if misconfigured, the WAN-side management port. The limiting factors are: valid admin authentication is mandatory (no unauthenticated path per PR:H), the target must be the specific affected firmware build (Gh-V1.0.0-B20250421.1327), and exploitation presupposes network reachability to the device's web UI, which is commonly restricted to the local network by default.

This is a stack-based buffer overflow (CWE-121) in the boa web server's formUploadFile handler on the TOTOLINK X2000R router, carrying a vendor/Talos CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The technical impact is severe - arbitrary code execution with full confidentiality/integrity/availability loss - and the network attack vector with low complexity makes triggering straightforward. However, two signals temper the raw score: PR:H means the attacker must already hold authenticated (effectively administrative) access to the device's web UI, and there is NO EPSS score, NO CISA KEV listing, and NO published proof-of-concept in the provided data, so there is no public exploit identified at time of analysis. The 9.1 is largely driven by the S:C (scope-changed) choice; a stack overflow in the httpd process compromising only the same router is more conventionally scored S:U, which would lower the base score - this is a point to verify with Talos. Net: a genuinely high-impact RCE but gated behind authentication, so realistic priority is moderate - meaningful for internet-exposed admin panels or as a post-authentication privilege/persistence step, less so where management access is already restricted. No active exploitation is evidenced.

An attacker who has obtained administrative credentials (or exploits an exposed/default-credential admin panel) on a TOTOLINK X2000R sends a specially crafted HTTP request to the boa formUploadFile endpoint, overflowing a stack buffer to execute arbitrary code on the router. No public proof-of-concept is identified at time of analysis, and the low attack complexity (AC:L) means a reliable exploit would be simple to trigger once authenticated.