Totolink X2000R: OS command injection in web administration (formWsc)
Summary
The Totolink X2000R home router with firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 has an OS command injection flaw in the boa web handler formWsc, parameter peerRptPin. An attacker who holds valid administrator credentials can send a crafted HTTP request and run arbitrary operating system commands on the device. The CVSS vector requires high privileges (PR:H) and network access, so the risk is highest if the web administration interface is reachable from the internet.
Affected
- Totolink X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only version listed by the sources)
Fixed in
Unknown. No vendor advisory or fixed firmware was found at the time of research.
Workaround
- No vendor workaround known.
- Disable remote (WAN) management of the web administration.
- Restrict access to the web administration to a trusted LAN segment.
- Change default administrator credentials and limit who can log in.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found; this does not prove that none exists.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS 0.01286 (low predicted exploitation probability).
Our recommendation
- Inventory all Totolink X2000R devices in your environment.
- Check whether the web administration is reachable from the WAN and disable remote management if it is.
- Restrict web administration to trusted LAN clients and enforce strong, unique administrator passwords.
- Check regularly for a vendor firmware update; if none is published, consider replacing the device.
- Monitor the device for unexpected configuration changes or outbound connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos TALOS-2026-2387 talosintelligence.com
- OpenCVE CVE-2026-35499 app.opencve.io
- Talos mirror TALOS-2026-2387 (Vulners) vulners.com
- CVE-2026-35499 (threatint mirror) cve.threatint.com
- CVE-2026-35499 (Strix) www.strix.ai
- EUVD-2026-105352 (Vulners, EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:03.
Original description (NVD)
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.