TOTOLINK X2000R: Stack-based buffer overflow in boa formUploadFile
Summary
A stack-based buffer overflow in the formUploadFile function of the boa web server on the TOTOLINK X2000R router allows arbitrary code execution. An attacker must first authenticate to the web administration interface and then send a specially crafted HTTP request. Successful exploitation gives the attacker control over the device, and the CVSS score is 9.1 (critical).
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
Fixed in
Unknown. No vendor fix or fixed firmware version had been published at the time of writing.
Workaround
No vendor workaround is published. General measures:
- Disable WAN and remote management.
- Keep the web administration interface on the LAN only.
- Change the default administrator credentials.
Exploitation
- CISA SSVC: exploitation none, automatable no.
- No public proof of concept found at the time of writing.
- Not listed as known exploited.
Our recommendation
- Inventory all TOTOLINK X2000R devices and check whether the web administration interface is reachable from the internet or from untrusted networks.
- Restrict access to the admin interface and disable remote management until a fix is available.
- Replace default credentials and monitor the TOTOLINK support site for firmware for this model; apply the fix promptly once it is released.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos TALOS-2026-2429 talosintelligence.com
- OpenCVE CVE-2026-9817 app.opencve.io
- Vulners Talos TALOS-2026-2429 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:54.
Original description (NVD)
A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.