An attacker with authenticated access to a TOTOLINK X2000R router can use an HTTP request to install arbitrary, unsigned firmware through the device's boa web server.
What Is It
CVE-2026-10141 is an unsigned firmware vulnerability (CWE-347: Improper Verification of Cryptographic Signature) in the firmware update feature of the boa web server on the TOTOLINK X2000R. Cisco Talos reported it as the CVE Numbering Authority. NVD's description says a specially crafted firmware binary can lead to an arbitrary firmware update, and an attacker triggers it with an authenticated HTTP request.
The record was published to NVD on 2026-10-20. Its status is "Received," so NVD has not finished its own analysis yet.
Why It Matters
Talos rates this flaw 9.1 (CRITICAL) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The vector breaks down as follows:
- Network-reachable with low attack complexity
- High privileges required, so the attacker must already be authenticated
- No user interaction needed
- Scope changed, meaning the impact reaches beyond the vulnerable component
- High impact on confidentiality, integrity and availability
The device doesn't check firmware signatures. An attacker who has administrative credentials, or who has taken over an authenticated session, can therefore replace the router's firmware with an image they control. Because the scope is "changed," the damage can extend past the web interface to the whole device.
Because the KEV entry provided for this CVE is empty, CISA's Known Exploited Vulnerabilities catalog doesn't confirm active exploitation. The supplied sources contain no evidence of exploitation in the wild.
What's Vulnerable
- Vendor: TOTOLINK
- Product: X2000R
- Affected version:
TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 - Component: boa web server, firmware update feature
The CNA record marks all other versions as unaffected by default. NVD lists no CPE entries yet.
Patch Status
The supplied NVD record doesn't mention a fixed firmware version or a vendor advisory. There's also no CISA KEV required action or due date, because the KEV entry is empty. Check the Talos advisory for vendor coordination details and updates on remediation.
Because the attacker must be authenticated, a reasonable interim measure is to restrict access to the router's management interface and protect administrative credentials. This advice is not stated in the source material.