A critical OS command injection flaw (CVSS 9.1) in the TOTOLINK X2000R's boa web server lets an authenticated attacker run arbitrary code with a specially crafted HTTP request.
What Is It
CVE-2026-33568 is an OS command injection vulnerability (CWE-78) in the formMapDelDevice macstr functionality of the boa web server on the TOTOLINK X2000R. A specially crafted HTTP request to this function can lead to arbitrary code execution. The attacker has to be authenticated to send the request.
Cisco Talos ([email protected]) reported the flaw, and NVD published it on 2026-10-20. Its NVD status is "Received," which means NVD has not yet analyzed it.
Why It Matters
The CNA scored the flaw 9.1 (CRITICAL) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Attack vector: Network. The flaw can be reached remotely over HTTP.
- Attack complexity: Low.
- Privileges required: High. The attacker needs authenticated, privileged access.
- User interaction: None.
- Scope: Changed. A successful attack can affect resources beyond the vulnerable component.
- Impact: High for confidentiality, integrity and availability.
The high privilege requirement limits who can exploit this. Even so, arbitrary code execution on a network edge device with changed scope is a serious risk. A compromised router sits in a privileged spot on the network.
Exploitation status: Neither of the sources cited below reports active exploitation or a listing in the CISA Known Exploited Vulnerabilities (KEV) catalog. Defenders should check the KEV catalog directly for the current status, because the CVE was published only today.
What's Vulnerable
The CNA lists this firmware as affected:
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The CNA record marks all other versions "unaffected" by default. NVD has not yet listed any CPE identifiers.
Patch Status
The NVD record has no information on patches or fixed firmware. The cited sources do not mention any CISA required action or remediation due date.
Owners of X2000R devices should check the Talos advisory and TOTOLINK's support channels for updated firmware. Until a fix is confirmed, limit who can reach the router's web management interface and who holds administrative credentials. Exploitation requires an authenticated request.