TOTOLINK X2000R: OS command injection in formWsc via targetAPSsid
Summary
The web administration interface of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) contains an OS command injection in the formWsc handler, processed via the targetAPSsid parameter. An attacker who is authenticated with administrative access can send a crafted HTTP request that executes arbitrary commands on the device. The CVSS score is 9.1 (critical), but the required high privileges and the authentication requirement are the main barriers, and no public exploit or in-the-wild exploitation is known.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
Fixed in
Unknown.
Workaround
- Unknown. The CVE record provides no workaround.
- Generic mitigation: block WAN access to the web administration interface and disable remote management.
Exploitation
- Authentication required (PR:H), attack over the network.
- No public exploit known; not listed in CISA KEV.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Check whether any TOTOLINK X2000R devices are in use, especially in branch offices, guest or IoT networks.
- Remove WAN access to the web administration interface and disable remote management.
- Change default and weak admin passwords and limit admin access.
- Monitor the router's admin logs for unexpected logins.
- Check https://www.totolink.net for firmware updates; if no fix is published, consider replacing the device with a supported model.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Talos Vulnerability Report TALOS-2026-2388 talosintelligence.com
- VulDB 423049 vuldb.com
- OpenCVE CVE-2026-40627 app.opencve.io
- Threat Intel mirror CVE-2026-40627 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:04.
Original description (NVD)
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.