CVE-2026-35499 is a critical (CVSS 9.1) OS command injection flaw in the Totolink X2000R's boa web server: an authenticated attacker can send a specially crafted HTTP request and run arbitrary code.
What Is It
The flaw is in the formWsc peerRptPin functionality of the boa web server on the Totolink X2000R. It is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). According to the NVD record, a specially crafted HTTP request can lead to arbitrary code execution, and the attacker must be authenticated to send it.
Cisco Talos, acting as the CNA, reported the vulnerability. NVD published the record on 2026-10-20 with a status of "Received," which means NVD has not yet completed its own analysis.
Why It Matters
Talos rates the flaw 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable with low attack complexity and no user interaction required
- High privileges required: the attacker needs authenticated access, which lowers the exploitability sub-score to 2.3
- Scope changed: a successful exploit can affect resources beyond the vulnerable component
- High impact to confidentiality, integrity and availability (impact sub-score 6.0)
Arbitrary code execution on an edge router gives an attacker a foothold on the network perimeter. The authentication requirement is the main barrier. That makes credential hygiene on the device's management interface especially important.
Exploitation status: As of publication, this CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation.
What's Vulnerable
According to the CNA-supplied affected data:
| Vendor | Product | Affected Version |
|---|---|---|
| totolink | Totolink (X2000R) | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
All other versions default to "unaffected" in the record. NVD has not yet assigned any CPE entries.
Patch Status
The supplied sources do not include any information about a fixed firmware release or vendor advisory. Because the CVE is not listed in KEV, CISA has issued no required action or due date. Administrators running the affected firmware build should:
- Watch Totolink and the Talos report (TALOS-2026-2387) for remediation guidance
- Restrict access to the router's web management interface
- Make sure administrative credentials are strong and not shared
Sources
- NVD: CVE-2026-35499
- Cisco Talos Vulnerability Report TALOS-2026-2387
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)