TOTOLINK X2000R EUVD-2026-105323

Exploitation requires an authenticated session with administrative privileges (PR:H) on the X2000R boa web management interface, from which the attacker invokes the firmware update functionality; the device accepts firmware binaries without cryptographic signature verification (CWE-347), so any crafted unsigned image is flashed. The primary limiting factor is the need for valid admin authentication beforehand - this is not a default-configuration unauthenticated flaw. Affected scope is the stated firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; exposure is amplified if the management interface is reachable remotely or protected only by default/weak credentials.

This is a high-CVSS (9.1) issue whose real-world risk is meaningfully gated by its privilege requirement. The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and the description agree that exploitation requires an authenticated HTTP request, and PR:H indicates administrative privileges on the boa web management interface are needed - the attacker must already control the device's admin session before the unsigned-firmware flaw (CWE-347) becomes exploitable. The score is inflated largely by the S:C scope change and triple-High impact; once an admin can flash arbitrary unsigned firmware, the result is total persistent device takeover, which is genuinely severe. However, no EPSS probability, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation. The signals are consistent (no conflict between CVSS network vector and the 'authenticated HTTP request' description), but the PR:H precondition makes this a 'critical-impact-but-authentication-gated' issue rather than a drop-everything unauthenticated RCE. Note the input Tags ('Information Disclosure', 'Jwt Attack') do not match a signature-verification/integrity flaw and appear mislabeled; the true impact is integrity/firmware tampering, not information disclosure.

An attacker who has obtained administrator credentials for a TOTOLINK X2000R (via phishing, default/weak credentials, or a separate auth flaw) crafts a malicious unsigned firmware binary and uploads it through the boa web server's firmware update function. Because the device does not verify the firmware's cryptographic signature (CWE-347), it accepts and flashes the attacker's image, yielding persistent control of the router. No public exploit code was identified at the time of analysis.