TOTOLINK X2000R: OS command injection in boa formWizard newPass
Summary
The web management interface (boa formWizard, newPass parameter) of the TOTOLINK X2000R router firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 does not sanitize user input before passing it to a system command. An authenticated attacker can send a specially crafted HTTP request to execute arbitrary commands on the device. The vulnerable path is only reached when the router is configured in Mesh mode, which can be set via the web portal.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
- Other firmware builds: Unknown.
Fixed in
Unknown. No fixed firmware version has been published by the vendor at the time of research.
Workaround
- Remove WAN/internet exposure of the web management interface and limit access to a trusted LAN segment or VPN.
- Change default and shared administrator credentials and review admin accounts.
- No vendor workaround is documented.
Exploitation
- No evidence of exploitation in the wild found; not listed in KEV.
- Talos SSVC: exploitation none, automatable no.
- EPSS 0.013.
- No public proof of concept found.
Our recommendation
- Check inventory for TOTOLINK X2000R devices and their exact firmware build.
- Confirm that the admin interface is not reachable from the internet and restrict it to trusted networks or VPN.
- Enforce strong, unique administrator passwords.
- Monitor TOTOLINK for a firmware fix and apply it when published; plan replacement if no fix appears.
- Monitor logs for unusual access to the web management interface.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos TALOS-2026-2428 talosintelligence.com
- OpenCVE CVE-2026-9814 app.opencve.io
- Strix CVE-2026-9814 www.strix.ai
- THREATINT CVE-2026-9814 cve.threatint.com
- Vulners Talos TALOS-2026-2428 vulners.com
- FortiGuard IPS encyclopedia fortiguard.fortinet.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:53.
Original description (NVD)
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.