CVE-2026-9827 is a critical (CVSS 9.1) arbitrary file write vulnerability in the boa web server's formUploadFile function on the TOTOLINK X2000R router. An authenticated attacker can exploit it with a specially crafted HTTP request to execute arbitrary code.
What Is It
The flaw is in the formUploadFile handler of the boa web server that runs on the TOTOLINK X2000R. Cisco Talos reported it and classifies it as CWE-22 (Path Traversal). A specially crafted HTTP request can write arbitrary files to the device, which can lead to arbitrary code execution. The attacker must send an authenticated HTTP request to trigger it.
NVD published the record on 2026-10-20. Its status is "Received," which means NVD has not yet completed its own analysis.
Why It Matters
Talos scores the issue 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network attack vector: the CVSS vector rates it as exploitable over the network with low attack complexity and no user interaction. Whether a given attacker can actually reach it depends on where the router's web management interface is exposed, for example only on the LAN or also on the WAN.
- High privileges required: the attacker needs authenticated access with elevated privileges. This lowers the exploitability sub-score to 2.3.
- Scope changed: a successful attack can affect resources beyond the vulnerable component, with high impact to confidentiality, integrity and availability (impact sub-score 6.0).
The authentication requirement narrows who can attack. Still, on an edge router, code execution through an arbitrary file write could give an attacker significant or full control of the device, depending on the privileges of the boa web server process and how the device is configured.
This CVE is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data contains no confirmation of active exploitation.
What's Vulnerable
- Vendor: TOTOLINK
- Product: X2000R
- Affected firmware:
TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
The CNA record lists only this firmware build as affected and treats all other versions as unaffected by default. The record contains no CPE entries.
Patch Status
The supplied NVD record contains no information about a vendor patch, fixed firmware version or official workaround. Because the CVE is not in KEV, there is no CISA-mandated required action or due date. Owners of X2000R devices on the affected build should check the Talos advisory and TOTOLINK for updated firmware or mitigation guidance.