CVE-2026-9869 is a critical (CVSS 9.1) stack-based buffer overflow in the TOTOLINK X2000R router's boa web server. An authenticated attacker can exploit it with a crafted HTTP request to run arbitrary code.
What Is It
The flaw is a stack-based buffer overflow (CWE-121) in the formTR069Config functionality of the boa web server on the TOTOLINK X2000R. A specially crafted HTTP request to this handler can lead to arbitrary code execution. The attacker must send an authenticated HTTP request to trigger it.
Cisco Talos reported the issue as the CVE Numbering Authority. NVD published the record on 2026-10-20 with a status of "Received," which means NVD has not finished its own analysis yet.
Why It Matters
The CNA-assigned CVSS v3.1 score is 9.1 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network attack vector, low complexity: the attack can be made remotely over HTTP and needs no special conditions.
- High privileges required: the attacker needs authenticated access with elevated rights. This keeps the exploitability score at 2.3.
- Scope changed, with high confidentiality, integrity and availability impact: successful exploitation can reach beyond the vulnerable component and fully compromise the device.
Code execution on an edge router gives an attacker a foothold at the network perimeter. Exposed management interfaces and weak or default admin credentials make the authentication requirement easier to meet.
KEV status: CVE-2026-9869 is not in the supplied CISA Known Exploited Vulnerabilities data, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: TOTOLINK
- Product: X2000R
- Affected firmware:
TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 - Component: boa web server,
formTR069Confighandler
The CNA record marks all other versions as "unaffected" by default and lists only the firmware build above as affected. NVD has not yet published CPE entries for this CVE.
Patch Status
The supplied NVD record does not mention a fixed firmware version or a vendor advisory. Because the CVE is not in KEV, there is no CISA-mandated required action or due date. Administrators running the affected build should:
- Check TOTOLINK for updated firmware.
- Review the Talos report for vendor coordination details.
- Limit access to the router's web management interface.
- Make sure administrative credentials are strong and not default.