---
id: "CVE-2026-10131"
kind: "vulnerability"
aliases: ["CVE-2026-10131"]
title: "TOTOLINK X2000R router: crafted HTTP request runs OS commands"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "X2000R", "fixed": [], "affected": "TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327", "ecosystem": "vendor"}]
ecosystems: []
tags: ["home-router", "infrastructure", "mesh", "router", "self-hosted", "totolink", "x2000r"]
not_affected_if: ["auth-required", "management-interface-not-exposed", "other-firmware-version", "wan-admin-disabled"]
published_at: "2026-10-20T21:17:15+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T23:19:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10131", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:19:06+00:00"}]
---

# TOTOLINK X2000R router: crafted HTTP request runs OS commands

OS command injection in formPasswordSetup of the boa web server on TOTOLINK X2000R firmware B20250421.1327. An authenticated admin who sets the new password while the router is in mesh mode gets arbitrary commands run, because newPass goes unsanitised into a system() call (Mcli). CVSS 9.1 (PR:H). No fix and no public exploit known; vendor acknowledged in June 2026 but has not published a patch.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:X2000R affected TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 fixed ?

## How to check

Log in to the router admin page and read the firmware version (System/Status). Exposed if it is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Also check whether the admin interface (/boafrm/*) answers from the WAN side; remote management should be off.

## Fix

No fixed firmware published as of 2026-10-23 (Talos timeline shows no vendor patch). Mitigate: disable WAN/remote management, use a strong unique admin password, keep mesh mode off if unused, restrict LAN admin access; watch totolink.net for new X2000R firmware.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-10131
- 2026-10-23T23:19:06+00:00 analyst — Read Talos TALOS-2026-2432 (primary, by Lilith Wyatt): authenticated, needs mesh mode flag; only build B20250421.1327 confirmed; no fixed version, vendor acked 2026-06-25. No public PoC or KEV (cyber-defence.io, Rapid7, EPSS ~1%). Did not search social posts. Sibling X2000R CVEs from same Talos batch.

## Documents

- [advisory] TALOS-2026-2432: Totolink X2000R boa formPasswordSetup OS command injection https://talosintelligence.com/vulnerability_reports/TALOS-2026-2432

## From the sources

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_