EUVD-2026-105332
GHSA-vh8v-g37q-6mg8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated router session
-
DeliverySend crafted HTTP request to formTR069Config
-
ExploitOverflow stack buffer in boa handler
-
ExecutionExecute arbitrary code on device
-
ImpactFull router compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated HTTP request to the boa web server's formTR069Config (TR-069/CWMP configuration) functionality on the TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 - i.e. the attacker must already possess valid management/admin credentials or control an authenticated session (CVSS PR:H). This authentication prerequisite is the primary limiting factor; there is no user-interaction requirement (UI:N) and complexity is low (AC:L), so once authenticated the overflow is directly reachable over the network. Realistic risk therefore depends heavily on management-interface exposure (LAN-only vs. WAN-reachable) and on credential hygiene; routers with the web UI exposed to untrusted networks and default/weak credentials are the practical attack surface. |
| Impact | The CVSS 3.1 base score is 9.1 (CRITICAL) driven by AV:N/AC:L, scope change (S:C), and full C:H/I:H/A:H impact, but the single most important modifier is PR:H - the Talos description explicitly states the attacker must make an *authenticated* HTTP request, so this is not a pre-auth internet-wide threat. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a genuine arbitrary-code-execution bug in an embedded router web server (boa), but its real-world priority is tempered by the authentication requirement: an attacker needs valid admin/management credentials or an already-compromised session to reach the formTR069Config handler. Note a modeling discrepancy worth verifying: Talos assigned Scope:Changed, which inflates the score, yet a stack overflow yielding code execution within the same boa process typically does not cross a security authority boundary (S:U is more defensible) - this materially affects the numeric score and should be confirmed with the vendor/Talos. Net: a real, high-severity device-takeover flaw, but gated behind authentication and currently without public exploit code, making it a patch-soon rather than patch-now emergency for most fleets. |
| Exploit ScenarioDerived | An attacker who holds valid management credentials for a TOTOLINK X2000R (or who has hijacked an authenticated admin session via CSRF, default/weak credentials, or a chained auth bypass) sends a specially crafted HTTP request to the boa web server's formTR069Config endpoint, overflowing a stack buffer and executing arbitrary code on the router. No public POC was provided in the input, so this remains a vendor/Talos-reported issue without confirmed public exploit code. Because AC:L, once an authenticated path exists the overflow is reliably triggerable with low complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Stack-based buffer overflow in the boa web server's formTR069Config handler on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 lets an authenticated attacker send a specially crafted HTTP request that overflows a fixed-size stack buffer and can lead to arbitrary code execution on the router. The flaw is network-reachable with low attack complexity, but exploitation requires valid management credentials (CVSS PR:H), making exposure of the administrative interface and credential hygiene the decisive risk factors. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 9.1 CRITICAL base score reflects full confidentiality, integrity and availability impact once the authentication barrier is crossed.
RemediationAI
No vendor-released patch has been identified at time of analysis, and no fixed firmware version is documented in the available data; monitor the Talos advisory TALOS-2026-2431 (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2431) and TOTOLINK's support channels for a firmware update, and apply it as soon as it is published. Until then, treat the management interface as the critical control surface: disable WAN-side remote management and restrict the boa web UI to a trusted LAN segment or management VLAN, accepting the trade-off that remote administration must move to VPN or an authenticated jump host; replace default and weak administrator credentials with unique strong passwords and rotate them, since valid credentials are the only prerequisite for triggering the overflow and credential compromise fully removes this barrier; and restrict or filter access to the formTR069Config endpoint at the network layer where feasible. None of these controls remove the underlying memory-safety defect, so segmenting the router's management plane from untrusted networks and monitoring for anomalous requests to TR-069 configuration paths should be maintained until patched firmware is available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is boa, a small embedded HTTP server widely used in consumer routers, running on the TOTOLINK X2000R. The formTR069Config endpoint processes configuration input associated with TR-069/CWMP, the DSL Forum protocol used for carrier-grade remote management of CPE devices; the handler copies attacker-controlled HTTP request data into a fixed-length stack buffer without adequate bounds validation. Per CWE-121, this is a stack-based buffer overflow: oversized input overwrites adjacent stack memory, including saved control data such as the return address, which allows the attacker to redirect execution and, per the vendor report, achieve arbitrary code execution in the context of the boa service (typically running with elevated privileges on embedded firmware). The supplied CPE string, cpe:2.3:a:totolink:totolink:*:*:*:*:*:*:*:*, is a wildcard that identifies the vendor but does not pin a specific model or firmware revision, so the version boundary must be taken from the Talos advisory TALOS-2026-2431 and the named firmware build rather than from CPE matching alone.
Know when TOTOLINK gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable (AV:N) but gated behind admin authentication (PR:H) per the description; code exec stays within the boa process so S:U rather than Talos's S:C; full C/I/A on device.
Primary rating from Vendor (talos).
CVSS VectorVendor: talos
DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Executive ViewAI
CVE-2026-9869 is a critical flaw in the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) that can let an attacker with valid administrative access take control of the device, exposing data and disrupting network availability. Leadership should care because an exposed management interface could turn these routers into a foothold for broader network compromise; no public exploit identified at time of analysis and it is not listed in CISA KEV.
No vendor-released patch identified at time of analysis; restrict management access to trusted networks or VPN, disable WAN-side administration, enforce strong unique administrative credentials and MFA where supported, segment routers from sensitive networks, monitor for anomalous formTR069Config or HTTP activity, and replace or isolate devices if exposure cannot be controlled.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Exploit-DB