TOTOLINK X2000R EUVD-2026-105335

Requires an authenticated administrative HTTP session to the router's boa web interface; the attacker then reaches the formWizard newPass functionality (the password/setup-wizard handler) and supplies a crafted request whose parameter is passed unsanitized to an OS command. Limiting factors: valid admin authentication is mandatory (PR:H), so exploitation depends on the attacker having or obtaining credentials - realistically via default/weak passwords or an exposed management interface - and is confined to the specific X2000R firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; there is no unauthenticated path and no public exploit identified at time of analysis.

The signals are moderately but not uniformly alarming. The input CVSS is 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H): network vector, low complexity, no user interaction, full triple impact, but critically PR:H - exploitation requires an already-authenticated (administrative) session on the router. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was identified at time of analysis, so there is no evidence of active exploitation. The high base score is driven largely by the Scope:Changed metric and full CIA impact; the authentication prerequisite is the dominant real-world mitigant. The Scope:Changed choice in the input is debatable - on an embedded device the boa web server typically runs as root under a single security authority, which argues for S:U and a lower (~7.2) score; this is flagged for verification rather than treated as fact. Net assessment: a credible post-authentication root-RCE in a consumer/SOHO router, researcher-reported by Cisco Talos, but gated behind admin authentication and without current exploitation signals - a solid patch-soon item rather than an emergency, unless the device's admin interface is internet-exposed with weak/default credentials, which would materially elevate the risk.

An attacker who already holds valid administrative credentials to a TOTOLINK X2000R web interface (e.g., default/weak credentials, or an exposed management port) sends a specially crafted HTTP request to the boa formWizard newPass handler, injecting OS commands that the firmware executes. Because the web server typically runs as root, this yields arbitrary code execution and full device takeover. No public exploit code was identified at time of analysis; the flaw was reported by Cisco Talos (TALOS-2026-2428).