An authenticated OS command injection flaw in the TOTOLINK X2000R's boa web server formPasswordSetup handler can let an attacker run arbitrary code with a crafted HTTP request.
What Is It
CVE-2026-10131 is an OS command injection vulnerability (CWE-78) in the formPasswordSetup functionality of the boa web server on the TOTOLINK X2000R. Cisco Talos reported it, and it was published to NVD on 2026-10-20.
According to the record, a specially crafted HTTP request can lead to arbitrary code execution. The attacker must send an authenticated HTTP request to trigger the vulnerability.
The CVSS v3.1 base score is 9.1 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability Impact: High / High / High
Why It Matters
Exploiting this flaw gives arbitrary code execution on the device. Because the scope is "Changed", the impact can reach beyond the vulnerable component itself. Attack complexity is low and no user interaction is needed. The main thing holding it back is the high-privilege requirement: an attacker needs authenticated access first.
That makes credential exposure the deciding factor. If an attacker gets admin credentials, for example through defaults, reuse or theft, this flaw turns that access into full code execution on the device.
Exploitation status: The supplied CISA KEV data has no entry for this CVE. Active exploitation is not confirmed by KEV at this time.
What's Vulnerable
The NVD record lists this version as affected:
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The record's default status is "unaffected" for versions not listed. NVD has not yet published any CPE entries for this CVE.
Patch Status
The source material does not list a fixed firmware version or vendor advisory. The NVD record is still at status "Received" and has not been fully analyzed. There is no CISA KEV entry, so no federal required action or remediation due date applies.
Owners of affected X2000R devices should check the Talos report and TOTOLINK's support channels for firmware updates. Until a fix is confirmed, limit who can reach the device's web management interface and who holds administrative credentials.
Sources
- NVD, CVE-2026-10131
- Cisco Talos; TALOS-2026-2432
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)