{"id":"CVE-2026-10132","kind":"vulnerability","aliases":["CVE-2026-10132"],"related":[],"title":"TOTOLINK X2000R router: stack overflow in web setup lets attackers run code","description":"A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Authenticated stack-based buffer overflow in the boa web server's formIpQos handler on the TOTOLINK X2000R. The 'mac' POST parameter (used with sqosadvAdd=1) is strcpy'd into a 0x22-byte stack buffer. A logged-in attacker gets code execution as root-level boa process. Talos reproduced control of the PC. CVSS 9.1. No vendor patch is published.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["firmware","infrastructure","iot","router","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required"],"how_to_check":"In the router admin UI (System/Status page) read the firmware version. If it is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 you are affected. Also check whether the admin interface is reachable from WAN (remote management setting).","fix":"No fixed firmware published as of 2026-10-23. Mitigate: turn off WAN/remote management, restrict the admin UI to a trusted LAN, change the default admin password to a strong unique one, and check totolink.net downloads for X2000R firmware newer than B20250421.1327.","status":"open","published_at":"2026-10-20T21:17:15+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:18+00:00","updated_at":"2026-10-23T23:18:01+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: stack overflow in web setup lets attackers run code","impact":"high","summary":"A stack-based buffer overflow in the boa web server's formIpQos MAC handler on the TOTOLINK X2000R router lets a crafted HTTP request run arbitrary code on the device. The attacker must first be logged in to the router's web interface.","category":"infrastructure","who_cares":["totolink","x2000r","router","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Code runs on the router as the attacker chooses","analyst_note":"Check the vendor for a firmware update past TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and confirm the affected firmware range from the NVD entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000477,"input_tokens":2963,"output_tokens":362,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor for a firmware update past TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and confirm the affected firmware range from the NVD entry.","search":"'-10132':15A,18A '-2026':14A,17A '0.0':115C '0x22':61B '0x22-byte':60B '1':54B '9.1':86B 'arbitrari':125C 'attack':10A,69B,129C 'authent':29B,133C 'b20250421.1327':116C 'base':32B,95C 'boa':37B,77B,102C 'buffer':33B,64B,96C 'byte':62B 'code':12A,71B,126C 'control':81B 'craft':119C 'cve':13A,16A 'cvss':85B 'd':57B 'execut':72B,127C 'exist':99C 'firmwar':20B 'formipqo':41B,103C 'function':105C 'get':70B 'gh':113C 'handler':42B 'host':26B 'http':120C,134C 'infrastructur':21B 'iot':22B 'lead':123C 'let':9A 'level':76B 'log':67B 'logged-in':66B 'mac':48B,104C 'make':131C 'overflow':5A,34B,97C 'paramet':50B 'patch':89B 'pc':84B 'post':49B 'process':78B 'publish':91B 'reproduc':80B 'request':121C,135C 'root':75B 'root-level':74B 'router':3A,23B 'run':11A 'self':25B 'self-host':24B 'server':39B 'setup':8A 'special':118C 'sqosadvadd':53B 'stack':4A,31B,63B,94C 'stack-bas':30B,93C 'strcpi':56B 'talo':79B 'totolink':1A,27B,45B,111C 'totolink-x2000r-gh-v1':110C 'trigger':137C 'use':51B 'v1':114C 'vendor':88B 'version':108C 'vulner':98C,139C 'web':7A,38B 'x2000r':2A,19A,28B,46B,107C,112C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10132","severity":null,"published_at":"2026-10-20T21:17:15+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10132:412","url":null,"severity":null,"published_at":"2026-10-23T23:18:01+00:00","modified_at":"2026-10-23T23:18:01+00:00","first_seen_at":"2026-10-23T23:18:01+00:00","fetched_at":"2026-10-23T23:18:01+00:00","note":"Read Talos TALOS-2026-2433 (primary, Oct 20 2026) and CVE record: only build B20250421.1327 listed, no vendor fix; vendor acknowledged 2026-06-25 but silent through Sep 15 follow-up. No exploitation or public PoC found; VulDB says no exploit. Social search skipped (no product-name conversation expected)."}],"documents":[{"id":1873,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2433","title":"TALOS-2026-2433 Totolink X2000R formIpQos mac stack overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1876,"url":"https://www.cve.org/CVERecord?id=CVE-2026-10132","title":"CVE Record CVE-2026-10132","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}