CVE-2026-9814 is a critical OS command injection flaw in the boa web server's formWizard newPass function on TOTOLINK X2000R firmware, and an authenticated attacker can use it to run arbitrary code.
What Is It
CVE-2026-9814 is an OS command injection vulnerability (CWE-78) in the boa formWizard newPass functionality of the TOTOLINK X2000R. A specially crafted HTTP request can lead to arbitrary code execution. The attacker must send an authenticated HTTP request to trigger it.
Cisco Talos ([email protected]) reported the flaw. NVD published it on 2026-10-20, and its NVD status is "Received."
Why It Matters
The CNA gives the flaw a CVSS v3.1 base score of 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. That vector means:
- Attack Vector: Network. The flaw can be reached remotely over the network.
- Attack Complexity: Low. No special conditions are needed to exploit it.
- Privileges Required: High. The attacker must already be authenticated with high privileges.
- User Interaction: None. No victim action is needed.
- Scope: Changed. A successful attack can affect resources beyond the vulnerable component.
- Confidentiality, Integrity and Availability: High. A successful attack could seriously compromise the device's confidentiality, integrity and availability.
The need for high privileges limits who can exploit it. Still, command injection on a network device could give an attacker who has credentials broad control over it, depending on the privileges the injected commands run with. Its exploitability subscore is 2.3 and its impact subscore is 6.0.
Exploitation status: The supplied CISA KEV entry is empty. KEV does not currently list this CVE, so active exploitation is not confirmed.
What's Vulnerable
The CNA lists one affected version:
- Vendor: TOTOLINK
- Product: X2000R
- Affected firmware:
TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
All other versions are marked unaffected by default. The NVD record does not list any CPE entries yet.
Patch Status
The source material does not mention a fixed firmware version, a vendor patch or workarounds. Because the CVE is not in KEV, CISA has set no required action or remediation deadline.
Owners of an X2000R on the affected firmware should check the Talos advisory and TOTOLINK for updates. Because exploitation needs authentication, it also makes sense to review who has administrative access to these devices.
Sources
- NVD: CVE-2026-9814
- Cisco Talos: TALOS-2026-2428
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE)