CVE-2026-9817 is a critical stack-based buffer overflow (CVSS 9.1) in the boa formUploadFile functionality of TOTOLINK X2000R firmware, where a specially crafted authenticated HTTP request can lead to arbitrary code execution.
What Is It
CVE-2026-9817 is a stack-based buffer overflow (CWE-121) in the boa formUploadFile functionality of the TOTOLINK X2000R. Cisco Talos, the reporting CNA, says a specially crafted HTTP request can trigger the flaw and lead to arbitrary code execution. The attacker must send an authenticated HTTP request to reach the vulnerable code.
The CVE was published to NVD on October 20, 2026, and its status is "Received." That means NVD has not yet published its own analysis. The technical details here come from the CNA's record and the linked Talos report.
Why It Matters
Talos scores the flaw at 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Here is what that vector means:
- Network attack vector, low complexity: an attacker can exploit it remotely, with no special conditions.
- High privileges required: the attacker needs authenticated access with elevated privileges. This lowers the exploitability score to 2.3.
- No user interaction: no victim action is needed.
- Scope changed, with high impact on confidentiality, integrity, and availability: a successful exploit can affect resources beyond the vulnerable component, up to full compromise.
The supplied data contains no CISA Known Exploited Vulnerabilities (KEV) entry for this CVE. KEV does not currently confirm active exploitation, and the sources include no CISA-mandated required action or due date.
What's Vulnerable
The CNA record lists the following affected version:
- Vendor: TOTOLINK
- Product: X2000R
- Affected firmware:
TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
The record's default status is "unaffected," so only the version listed above is confirmed vulnerable. No CPE entries are published for this CVE yet.
Patch Status
The supplied sources do not mention a fixed firmware version, vendor advisory, or workaround. There is also no KEV remediation requirement, because the CVE is not listed in KEV. Owners of X2000R devices running the affected firmware should check the Talos report and TOTOLINK for updates. Because exploitation requires high-privilege authenticated access, it also helps to limit who holds administrative credentials to the device and who can reach its HTTP interface.
Sources
- NVD, CVE-2026-9817
- Cisco Talos; TALOS-2026-2429
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)