An authenticated OS command injection flaw in the Totolink X2000R router's boa web server lets an attacker run arbitrary code by sending a crafted HTTP request to the formWsc targetAPSsid functionality.
What Is It
CVE-2026-40627 is an OS command injection vulnerability (CWE-78) in the formWsc targetAPSsid functionality of the boa web server on the Totolink X2000R. Cisco Talos reported it, and it was published to NVD on 2026-10-20. A specially crafted HTTP request can lead to arbitrary code execution. The attacker must be authenticated to send the request.
NVD lists the record's status as "Received", which means NVD has not yet analyzed it. The CVSS score below comes from the CNA (Talos).
Why It Matters
Talos rates the flaw 9.1 (CRITICAL) under CVSS 3.1:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Attack vector: Network
- Attack complexity: Low
- Privileges required: High
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, integrity and availability
The high privilege requirement lowers the exploitability score (2.3). Even so, the changed scope and full impact on confidentiality, integrity and availability make this a serious risk. An attacker with administrative credentials, whether stolen, default or reused, could run code on the router itself. That gives them a foothold on the network edge.
Exploitation status: The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for CVE-2026-40627. KEV does not currently confirm active exploitation.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| Totolink | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The CNA record lists this single firmware build as affected and marks all other versions as unaffected by default. NVD has not published any CPE entries yet.
Patch Status
The source data does not mention a fixed firmware version or vendor advisory. There is no CISA KEV entry, so no federal remediation deadline or required action applies.
Until Totolink confirms a fix, owners of X2000R devices running the affected build should:
- Check the Talos advisory and the Totolink support channels for updated firmware.
- Restrict access to the router's web management interface.
- Make sure administrative credentials are strong and unique, since exploitation requires an authenticated request.
Sources
- NVD, CVE-2026-40627
- Cisco Talos; TALOS-2026-2388
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE)