TOTOLINK X2000R EUVD-2026-105333

Exploitation requires an authenticated HTTP request to the boa web server's formUploadFile functionality on a TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327); the attacker must already possess valid credentials to the device's web administration interface. The specific prerequisite is reachable network access to the router's HTTP management interface plus valid login. LIMITING FACTORS: authentication is mandatory (PR:H), so this is not exploitable by a fully unauthenticated attacker; realistic risk is concentrated on devices with exposed admin interfaces or weak/default credentials. No user interaction is required (UI:N) and attack complexity is low (AC:L) once authenticated.

This is a genuine high-severity issue but with an important gating factor. The CVSS vector (AV:N/AC:L/PR:H/UI:N) and the description agree on one key point: exploitation requires authentication (PR:H), and the description explicitly states 'an authenticated HTTP request' is needed - so the signals are consistent, not conflicting. The 9.1 score is driven by the scope change (S:C) and full C/I/A impact via arbitrary file write escalating to code execution. However, no EPSS probability was provided, the CVE is NOT in CISA KEV (no confirmed active exploitation), and no public POC was identified at time of analysis - so there is no public exploit identified at time of analysis. The practical risk ceiling is therefore lower than the raw 9.1 suggests: an attacker must first obtain valid credentials to the router's web/boa interface. That said, SOHO routers like TOTOLINK are heavily targeted by botnets, frequently ship with weak/default credentials, and often expose admin interfaces, so the PR:H barrier is weaker in practice than on hardened enterprise gear. Treat as a real patch priority for exposed devices, but not an unauthenticated internet-wormable flaw.

An attacker who has obtained valid router admin credentials (e.g., default/weak passwords or a prior compromise) sends a specially crafted HTTP request to the boa web server's formUploadFile handler, using path traversal (CWE-22) to write a malicious file to an arbitrary location on the device filesystem. This planted file is then executed, yielding arbitrary code execution on the router. No public POC was identified at time of analysis, and exploitation requires authentication per the CVSS PR:H metric.