{"id":"CVE-2026-10131","kind":"vulnerability","aliases":["CVE-2026-10131"],"related":[],"title":"TOTOLINK X2000R router: crafted HTTP request runs OS commands","description":"An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"OS command injection in formPasswordSetup of the boa web server on TOTOLINK X2000R firmware B20250421.1327. An authenticated admin who sets the new password while the router is in mesh mode gets arbitrary commands run, because newPass goes unsanitised into a system() call (Mcli). CVSS 9.1 (PR:H). No fix and no public exploit known; vendor acknowledged in June 2026 but has not published a patch.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["home-router","infrastructure","mesh","router","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","management-interface-not-exposed","other-firmware-version","wan-admin-disabled"],"how_to_check":"Log in to the router admin page and read the firmware version (System/Status). Exposed if it is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Also check whether the admin interface (/boafrm/*) answers from the WAN side; remote management should be off.","fix":"No fixed firmware published as of 2026-10-23 (Talos timeline shows no vendor patch). Mitigate: disable WAN/remote management, use a strong unique admin password, keep mesh mode off if unused, restrict LAN admin access; watch totolink.net for new X2000R firmware.","status":"open","published_at":"2026-10-20T21:17:15+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:19+00:00","updated_at":"2026-10-23T23:19:06+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: crafted HTTP request runs OS commands","impact":"high","summary":"The TOTOLINK X2000R router's boa web server has an OS command injection flaw in its formPasswordSetup handler, reported against firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution on the device.","category":"infrastructure","who_cares":["totolink","x2000r","home-router","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker runs commands as root on the router","analyst_note":"Confirm the fixed firmware version and whether the web admin interface is reachable from WAN; check the NVD entry for the vendor advisory link.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-firmware-version","management-interface-not-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000485,"input_tokens":2953,"output_tokens":380,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether the web admin interface is reachable from WAN; check the NVD entry for the vendor advisory link.","search":"'-10131':12A,15A '-2026':11A,14A '0.0':113C '2026':86B '9.1':72B 'acknowledg':83B 'admin':45B 'arbitrari':59B,123C 'attack':127C 'authent':44B,131C 'b20250421.1327':42B,114C 'boa':35B,101C 'call':69B 'code':124C 'command':9A,29B,60B,95C 'craft':4A,117C 'cve':10A,13A 'cvss':71B 'execut':125C 'exist':98C 'exploit':80B 'firmwar':41B 'fix':76B 'formpasswordsetup':32B,102C 'function':103C 'get':58B 'gh':111C 'goe':64B 'h':74B 'home':18B 'home-rout':17B 'host':25B 'http':5A,118C,132C 'infrastructur':20B 'inject':30B,96C 'june':85B 'known':81B 'lead':121C 'make':129C 'mcli':70B 'mesh':21B,56B 'mode':57B 'new':49B 'newpass':63B 'os':8A,28B,94C 'password':50B 'patch':92B 'pr':73B 'public':79B 'publish':90B 'request':6A,119C,133C 'router':3A,19B,22B,53B 'run':7A,61B 'self':24B 'self-host':23B 'server':37B 'set':47B 'special':116C 'system':68B 'totolink':1A,26B,39B,109C 'totolink-x2000r-gh-v1':108C 'trigger':135C 'unsanitis':65B 'v1':112C 'vendor':82B 'version':106C 'vulner':97C,137C 'web':36B 'x2000r':2A,16A,27B,40B,105C,110C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10131","severity":null,"published_at":"2026-10-20T21:17:15+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10131:413","url":null,"severity":null,"published_at":"2026-10-23T23:19:06+00:00","modified_at":"2026-10-23T23:19:06+00:00","first_seen_at":"2026-10-23T23:19:06+00:00","fetched_at":"2026-10-23T23:19:06+00:00","note":"Read Talos TALOS-2026-2432 (primary, by Lilith Wyatt): authenticated, needs mesh mode flag; only build B20250421.1327 confirmed; no fixed version, vendor acked 2026-06-25. No public PoC or KEV (cyber-defence.io, Rapid7, EPSS ~1%). Did not search social posts. Sibling X2000R CVEs from same Talos batch."}],"documents":[{"id":1880,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2432","title":"TALOS-2026-2432: Totolink X2000R boa formPasswordSetup OS command injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}