CVE-2026-28763 is a critical stack-based buffer overflow in the hostname handling of the boa web server's formMapDelDevice function on the TOTOLINK X2000R, and an authenticated attacker can exploit it with a specially crafted HTTP request to execute arbitrary code.
What Is It
The flaw is a stack-based buffer overflow (CWE-121) in the boa formMapDelDevice hostname handling of TOTOLINK X2000R firmware. According to the NVD record, a specially crafted HTTP request can lead to arbitrary code execution. The attacker must make an authenticated HTTP request to trigger it.
Cisco Talos ([email protected]) reported the vulnerability, and NVD published it on 2026-10-20. NVD's analysis status is "Received," which means the record has not yet been enriched.
Why It Matters
Talos gives the flaw a CVSS v3.1 base score of 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. In practice:
- Network-reachable with low attack complexity and no user interaction.
- High privileges are required, so the attacker needs authenticated access to the device's web interface.
- Scope is changed, meaning a successful exploit can affect resources beyond the vulnerable component, with high impact to confidentiality, integrity, and availability.
The high privilege requirement narrows who can exploit this flaw. Even so, an attacker who can run code on an edge router could use it to intercept or tamper with network traffic.
KEV status: The supplied CISA KEV entry is empty. CVE-2026-28763 is not currently listed in the Known Exploited Vulnerabilities catalog, and the supplied data does not confirm active exploitation.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The CNA record lists the default status as "unaffected," so only the firmware build above is explicitly marked as affected. NVD has not published any CPE entries yet.
Patch Status
The supplied NVD record does not list a vendor patch, a fixed firmware version, or vendor guidance. Because there is no KEV entry, there is also no CISA required action or due date. Owners of the X2000R should:
- watch TOTOLINK for updated firmware;
- review the Talos advisory for vendor coordination details;
- restrict access to the router's web management interface to trusted administrators and networks; and
- make sure administrative credentials are strong and not shared, since the attacker needs authenticated access.
Sources
- NVD, CVE-2026-28763
- Cisco Talos; TALOS-2026-2389
- CISA Known Exploited Vulnerabilities Catalog (not listed as of publication)