CVE-2026-10137 is a critical stack-based buffer overflow in the boa web server's formUpload() function on TOTOLINK X2000R routers, and an authenticated HTTP request can exploit it to run arbitrary code.
What Is It
CVE-2026-10137 is a stack-based buffer overflow (CWE-121) in the formUpload() function of the boa web server on the TOTOLINK X2000R. Cisco Talos reported it as the CNA, and NVD published it on October 20, 2026. According to the NVD description, a specially crafted HTTP request can lead to arbitrary code execution. The attacker must send that request while authenticated.
Why It Matters
The CVSS v3.1 base score is 9.1 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. That vector means:
- Network-reachable: an attacker can send the request remotely, and attack complexity is low.
- Needs high privileges: the attacker must be authenticated with elevated rights. This limits who can exploit it but does not remove the risk.
- No user interaction: no one has to click or approve anything for the exploit to work.
- Scope changed: a successful exploit can affect resources beyond the vulnerable component.
- High impact: confidentiality, integrity and availability are all rated high.
Code execution on an edge router gives an attacker a foothold at the network perimeter. The CISA KEV catalog does not list this CVE in the supplied data, so active exploitation is not confirmed. The NVD record is still in "Received" status and has not been fully analyzed.
What's Vulnerable
- Vendor: TOTOLINK
- Product: X2000R
- Affected version:
TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 - Component: the formUpload() handler in the boa web server
The CNA data marks other versions as unaffected by default. No CPE entries are listed yet.
Patch Status
The supplied NVD data does not mention a vendor patch or fixed firmware version. CISA has published no required action because the CVE is not in the KEV catalog. Owners of affected X2000R devices should check the Talos advisory and TOTOLINK for firmware updates. Until a fix is confirmed, they should limit who has administrative access to the device's web interface.
Sources
- NVD – CVE-2026-10137
- Cisco Talos – TALOS-2026-2437
- CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of publication)