CVE-2026-40627
CriticalCVSS 9.1Summary
An OS command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Risk Assessment
An authenticated attacker can execute arbitrary commands on the device, taking full control of it. This can lead to complete compromise of confidentiality, integrity, and availability of the network managed by the router.
Recommendation
Update the device firmware to a fixed version if the vendor provides one. Until then, restrict access to the administrative interface and change default credentials.
Other vulnerabilities in Totolink X2000R
See all- CVE-2026-9869Critical
A stack-based buffer overflow in the boa formTR069Config functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
- CVE-2026-9827Critical
An arbitrary file write vulnerability in the boa formUploadFile functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
- CVE-2026-9817Critical
A stack-based buffer overflow in the boa formUploadFile functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
- CVE-2026-9814Critical
An OS command injection vulnerability in the boa formWizard newPass functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
- CVE-2026-9660Critical
Multiple exploitable stack-based buffer overflows in the boa formFilter functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327), involving the vpnPassword parameter. A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
- CVE-2026-9659Critical
Multiple exploitable stack-based buffer overflows in the boa formFilter functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327), involving the vpnUser parameter. A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.
- CVE-2026-42026Critical
A stack-based buffer overflow exists in the boa formIpv6Setup dhcp_dns functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the dhcp_dns2 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
- CVE-2026-42025Critical
A stack-based buffer overflow exists in the boa formIpv6Setup dhcp_dns functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the dhcp_dns1 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
- CVE-2026-42024Critical
A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_gw parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
- CVE-2026-42023Critical
A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_ipv6 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.
Original NVD description (English source)
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS