CVE-2026-10132 is a critical stack-based buffer overflow in the TOTOLINK X2000R router's Boa web server; an authenticated attacker can exploit it with a crafted HTTP request to execute arbitrary code.
What Is It
CVE-2026-10132 is a stack-based buffer overflow (CWE-121) in the formIpQos MAC handling of the Boa web server on the TOTOLINK X2000R. Cisco Talos reported it as the CVE Numbering Authority (CNA). According to the vulnerability description, a specially crafted HTTP request can lead to arbitrary code execution. The attacker must send the request with authentication.
NVD published the record on 2026-10-20. Its status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
Talos rates the flaw 9.1 (CRITICAL) under CVSS 3.1:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Attack vector: Network, with low attack complexity
- Privileges required: High, so the attacker must already have authenticated access
- User interaction: None
- Scope: Changed, meaning a successful exploit can affect resources beyond the vulnerable component
- Impact: High for confidentiality, integrity, and availability
The high privilege requirement limits who can trigger the bug. Even so, code execution on an edge router can give an attacker full control of the device. Anyone who obtains or reuses admin credentials could exploit it.
Exploitation status: CVE-2026-10132 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The CNA record lists the default status for other versions as "unaffected." NVD has not published CPE data yet.
Patch Status
The supplied NVD record does not mention a fixed firmware version or vendor patch. Because there is no KEV entry, there is no CISA-mandated required action or due date.
Until a fix is confirmed, defenders should:
- Check the Talos advisory and TOTOLINK for firmware updates.
- Restrict access to the router's web management interface to trusted networks.
- Make sure administrative credentials are strong and unique, since exploitation requires authenticated access.
Sources
- Cisco Talos Vulnerability Report TALOS-2026-2433
- NVD: CVE-2026-10132
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-10132 is not listed)