TOTOLINK X2000R: OS command injection in boa formUpload()

Summary

The boa web administration server of the TOTOLINK X2000R router contains an OS command injection in the formUpload() handler. An authenticated attacker can send a specially crafted HTTP request to execute arbitrary code on the device. The attack requires valid high-privilege credentials and, per Talos's testing, a device in mesh mode or a configuration set up by the attacker.

Affected

• TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
• Other firmware builds: Unknown.

Fixed in

Unknown. No vendor advisory or fixed firmware build was found.

Workaround

• No vendor workaround documented.
• Keep the admin interface off the WAN and restrict it to trusted LAN hosts.
• Change default admin credentials.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Not listed in CISA KEV.
• No public proof of concept or exploitation reports found; this does not prove none exist.

Our recommendation

• Identify TOTOLINK X2000R devices running the affected firmware build.
• Confirm the admin interface is not reachable from the internet and rotate admin passwords.
• Ask TOTOLINK for a fixed firmware and monitor its firmware releases.
• Replace the device if no fix is issued.
• Verify the scoring against nvd.nist.gov, as NVD status is Deferred.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Talos TALOS-2026-2438 talosintelligence.com
• OpenCVE CVE-2026-10138 app.opencve.io
• Vulners TALOS-2026-2438 vulners.com
• Strix CVE-2026-10138 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:10.