CVE-2026-9660 is a critical (CVSS 9.1) stack-based buffer overflow in the boa web server's formFilter functionality on the TOTOLINK X2000R. An authenticated attacker can use it to run arbitrary code through the vpnPassword parameter.
What Is It
CVE-2026-9660 is one of several stack-based buffer overflows (CWE-121) in the boa formFilter functionality of the TOTOLINK X2000R. A specially crafted HTTP request can lead to arbitrary code execution. This CVE covers the flaw reached through the vpnPassword parameter. Cisco Talos assigned the CVE, and NVD published it on 2026-10-20. Its NVD status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
Talos scored the flaw 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable with low attack complexity and no user interaction required
- High privileges required, because the attacker must send an authenticated HTTP request
- Scope changed, meaning a successful attack can affect resources beyond the vulnerable component
- High impact to confidentiality, integrity and availability
Requiring high privileges limits who can exploit it. Being able to reach the management interface is not enough on its own, because the attacker also needs valid high-privilege credentials. Still, an attacker who has or steals admin credentials and can reach a device's web management interface could take full control of it. As of publication (2026-10-20), CVE-2026-9660 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog. Active exploitation is therefore not confirmed, but the CVE was published today, and CISA adds entries as it receives evidence of exploitation.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The CNA record lists the product's default status as "unaffected." Only the firmware build above is listed as affected. NVD has not published any CPE entries yet.
Patch Status
The NVD record does not say whether a fixed firmware version exists, and it gives no remediation guidance. Because CVE-2026-9660 was not in the CISA KEV catalog as of publication, CISA has set no required action or due date. Owners of affected X2000R devices should read the Talos advisory and check TOTOLINK for firmware updates. Until a fix is confirmed, limit who can reach the web management interface and keep admin credentials secure.