An authenticated attacker can send a crafted HTTP request to TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and trigger a stack-based buffer overflow that can lead to arbitrary code execution.
What Is It
CVE-2026-10139 is a stack-based buffer overflow (CWE-121) in the Mcli functionality of the TOTOLINK X2000R. Cisco Talos reported it as the CVE Numbering Authority. Talos says a specially crafted HTTP request can lead to arbitrary code execution, and that the attacker must make an authenticated HTTP request to trigger it.
NVD published the record on 2026-10-20. Its status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
Talos scored the flaw CVSS 3.1 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network attack vector, low complexity: the device can be reached over the network, and no special conditions are needed to exploit it.
- High privileges required: the attacker needs authenticated access with elevated rights. This is the main factor limiting exposure.
- No user interaction
- Scope changed: a successful exploit can affect resources beyond the vulnerable component.
- High impact on confidentiality, integrity and availability.
The exploitability subscore is 2.3 and the impact subscore is 6.0. Because the attacker needs privileged access, the risk is highest where admin credentials are weak, shared, default or already compromised, or where the management interface is reachable by untrusted users.
Exploitation status: CVE-2026-10139 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication. Active exploitation is not confirmed, and no KEV remediation deadline applies.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The CNA record sets the default status to "unaffected," so only the firmware build above is listed as vulnerable. The record lists no CPEs.
Patch Status
The NVD record does not identify a fixed firmware version or vendor advisory. Since the CVE is not listed in the CISA KEV catalog, CISA has not set a required action. Owners of affected X2000R units should:
- Check the Talos report (TALOS-2026-2439) and TOTOLINK for updated firmware.
- Until a fix is confirmed, limit access to the device's HTTP management interface to trusted networks.
- Make sure administrative credentials are strong and not shared, since exploitation requires an authenticated request.