An authenticated OS command injection flaw in the boa web server's formUpload() function on the TOTOLINK X2000R can let an attacker run arbitrary code with a specially crafted HTTP request.
What Is It
CVE-2026-10138 is an OS command injection vulnerability (CWE-78) in the formUpload() functionality of the boa web server used by the TOTOLINK X2000R. Per the NVD description, a specially crafted HTTP request can lead to arbitrary code execution. The attacker must be authenticated to send that request.
Cisco Talos ([email protected]) reported the issue, and NVD published it on 2026-10-20. The NVD record currently has the status "Received."
Why It Matters
Talos rates the flaw 9.1 (CRITICAL) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable with low attack complexity and no user interaction required
- High privileges required, so the attacker needs authenticated access first
- Scope changed: a successful exploit can affect resources beyond the vulnerable component
- High impact to confidentiality, integrity, and availability
The exploitability subscore is 2.3 and the impact subscore is 6.0. The privilege requirement limits who can exploit it. However, anyone with valid credentials, or who has compromised them, could turn that access into code execution on the device.
Exploitation status: The supplied CISA KEV data contains no entry for this CVE. Active exploitation is not confirmed by KEV at this time.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The CNA record lists only this firmware build as affected and marks every other version as "unaffected" by default. NVD has not yet published any CPE entries.
Patch Status
The supplied NVD record does not identify a fixed firmware version or vendor advisory. With no KEV entry, there is also no CISA-mandated action or due date. Owners of affected X2000R devices should read the Talos report linked below and watch for vendor firmware updates. Because exploitation requires authentication, limiting who can reach and log in to the device's web interface reduces exposure until a fix is confirmed.
Sources
- NVD: CVE-2026-10138
- Cisco Talos: TALOS-2026-2438
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE as of publication)