A critical OS command injection flaw (CVSS 9.1) in the batchupg functionality of the TOTOLINK X2000R lets an authenticated attacker run arbitrary code with a specially crafted HTTP request.
What Is It
CVE-2026-10135 is an OS command injection vulnerability (CWE-78) in the batchupg functionality of the TOTOLINK X2000R. A specially crafted HTTP request can lead to arbitrary code execution. The attacker has to be authenticated to send the request that triggers it.
Cisco Talos ([email protected]) reported the vulnerability, which was published to NVD on 2026-10-20. Its NVD status is "Received," so NVD has not yet done its own analysis.
Why It Matters
Talos rates the flaw 9.1 (CRITICAL) under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network-exploitable with low attack complexity
- No user interaction required
- Scope changed, so the impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity, and availability
The main limit is high privileges required (PR:H): an attacker needs authenticated access with elevated privileges. This explains the lower exploitability subscore of 2.3, set against an impact subscore of 6.0. Even so, on a network device, arbitrary code execution through command injection can give an attacker full control of the device.
KEV status: This CVE is not in the CISA Known Exploited Vulnerabilities catalog. The supplied KEV data does not confirm active exploitation.
What's Vulnerable
According to the CNA-supplied affected data:
| Vendor | Product | Affected Version |
|---|---|---|
| totolink | Totolink (X2000R) | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The default status for other versions is listed as "unaffected." NVD has not yet published CPE entries for this record.
Patch Status
The supplied NVD record does not include patch or fixed-version information. There is also no CISA KEV entry, so no federal remediation requirement or due date applies. Defenders should:
- Check the Talos advisory (TALOS-2026-2435) and TOTOLINK for firmware updates
- Restrict access to the X2000R's web management interface to trusted networks
- Audit and limit administrative accounts, since exploitation requires authenticated, high-privilege access
Sources
- NVD: CVE-2026-10135
- Cisco Talos: TALOS-2026-2435
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE)