CVE-2026-9659 is a critical (CVSS 9.1) stack-based buffer overflow in the boa web server's formFilter functionality on the TOTOLINK X2000R router, where an authenticated HTTP request can lead to arbitrary code execution.
What Is It
CVE-2026-9659 is one of several stack-based buffer overflows (CWE-121) in the boa formFilter functionality of the TOTOLINK X2000R. This CVE covers the flaw in the vpnUser parameter. Cisco Talos, the reporting CNA, says a specially crafted HTTP request can trigger the overflow and lead to arbitrary code execution. The attacker must send an authenticated HTTP request.
NVD published the record on 2026-10-20. Its status is "Received," so NVD has not finished its own analysis yet.
Why It Matters
Talos gave the flaw a CVSS 3.1 base score of 9.1 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Key points from the vector:
- Network-reachable: the attack is delivered over the network with low complexity.
- Privileges required: High. The attacker needs authenticated access with high privileges, which limits who can exploit it.
- No user interaction is needed.
- Scope changed: a successful attack can affect resources beyond the vulnerable component, with high impact to confidentiality, integrity and availability.
This flaw is one of several related overflows in the same formFilter handler. Defenders should expect sibling CVEs that cover other parameters.
The supplied CISA KEV data contains no entry for this CVE. Active exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: TOTOLINK
- Product: X2000R
- Affected firmware:
TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 - Component: boa web server, formFilter functionality,
vpnUserparameter
The CNA lists the product's default status as "unaffected," with only the version above marked as affected. NVD has not published any CPE entries yet.
Patch Status
The supplied NVD record contains no information about a fixed firmware version or vendor advisory. CISA has issued no KEV required action or due date, because the CVE is not in the KEV catalog. Owners of affected X2000R devices should check the Talos report and TOTOLINK for updated firmware. Because exploitation requires high-privilege authentication, administrative access to the device's web interface should be tightly controlled.
Sources
- NVD, CVE-2026-9659
- Cisco Talos; TALOS-2026-2425
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE as of publication)