CVE-2026-10133 is a critical (CVSS 9.1) stack-based buffer overflow in the batchupg functionality of TOTOLINK X2000R firmware that can lead to arbitrary code execution through a specially crafted, authenticated HTTP request.
What Is It
CVE-2026-10133 is a stack-based buffer overflow (CWE-121) in the batchupg functionality of the TOTOLINK X2000R. The NVD description says a specially crafted HTTP request can lead to arbitrary code execution. The attacker must be authenticated to send that request.
Cisco Talos reported the vulnerability as the assigning CNA under advisory TALOS-2026-2434. NVD published the record on 2026-10-20, and its status is currently "Received."
Why It Matters
Talos rates the flaw 9.1 CRITICAL with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Here's what that vector means:
- Network attack vector, low complexity: an attacker can reach and trigger it remotely without special conditions.
- High privileges required: the attacker needs authenticated access with elevated privileges. This is the main limit on exploitation.
- No user interaction
- Changed scope: a successful exploit can affect resources beyond the vulnerable component.
- High impact to confidentiality, integrity, and availability.
The CISA KEV catalog has no entry for CVE-2026-10133 in the supplied data, so active exploitation is not confirmed at this time.
What's Vulnerable
According to the CNA-supplied affected data:
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The record's default status is "unaffected," so only the firmware build listed above is formally marked as affected. The NVD record does not list any CPEs yet.
Patch Status
The supplied NVD and KEV data say nothing about a vendor patch, fixed firmware version, or workaround. CISA has not issued a KEV required action or remediation due date because the vulnerability is not in the KEV catalog.
Owners of X2000R devices running the affected build should:
- Check the Talos advisory (TALOS-2026-2434) and TOTOLINK for updated firmware.
- Because exploitation requires high privileges, restrict who has administrative access to the device's web interface until a fix is confirmed.
Sources
- NVD, CVE-2026-10133
- Cisco Talos; TALOS-2026-2434
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)