A critical heap-based buffer overflow in the boa web server's formUpload() function on the TOTOLINK X2000R router can let an authenticated attacker run arbitrary code using a specially crafted HTTP request.
What Is It
CVE-2026-10136 is a heap-based buffer overflow (CWE-122) in the formUpload() function of the boa web server on the TOTOLINK X2000R. Cisco Talos reported it as a CNA, and NVD published it on October 20, 2026. Its NVD status is currently "Received."
An attacker who sends a specially crafted, authenticated HTTP request to the vulnerable function can trigger the overflow, which can lead to arbitrary code execution on the device.
Why It Matters
Talos rates the flaw CVSS 3.1 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable with low attack complexity
- No user interaction needed
- Scope changed: the impact reaches beyond the vulnerable component
- High impact to confidentiality, integrity, and availability
The main limit is that the attacker needs high privileges (PR:H), which matches the description's requirement for an authenticated request. That gives an exploitability subscore of 2.3, against an impact subscore of 6.0. Anyone holding admin credentials, whether stolen, default, or obtained another way, could use this to take full control of the router.
Exploitation status: No CISA KEV entry accompanies this CVE at the time of writing, so active exploitation in the wild is not confirmed.
What's Vulnerable
| Field | Value |
|---|---|
| Vendor | TOTOLINK |
| Product | X2000R |
| Affected version | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
| Component | boa web server, formUpload() |
| Default status | Unaffected (only the listed version is marked affected) |
The NVD record does not yet include any CPE entries.
Patch Status
The supplied NVD data does not mention a fixed firmware version or vendor patch, and there is no CISA KEV required action or due date. Administrators running the affected X2000R build should:
- Read the Talos advisory (TALOS-2026-2436) for vendor coordination details and any fix information.
- Watch TOTOLINK for updated firmware.
- Limit who can reach the router's web management interface, and protect administrative credentials, since exploitation requires authentication.