{"id":"CVE-2026-10133","kind":"vulnerability","aliases":["CVE-2026-10133"],"related":[],"title":"TOTOLINK X2000R router: batchupg overflow lets an attacker run code","description":"A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Stack buffer overflow in the batchupg helper binary on the TOTOLINK X2000R (CWE-121, CVSS 9.1). An authenticated admin POST to /boafrm/formBuploadSetting starts batchupg, which listens for UDP broadcast on port 13977. A crafted packet's csid field overflows a stack buffer in send_broadcast_resp and gives code execution as the router. Talos reached a crash with control of the program counter. No vendor patch is known.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R firmware","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","iot","rce","router","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","other-models","wan-admin-disabled"],"how_to_check":"In the router admin page, read the firmware version. You are affected if it is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. No command is published. Also check whether the web admin is reachable from the WAN (remote management setting) and whether untrusted devices share your LAN.","fix":"unknown: no fixed firmware is named by Talos, the CVE record or the sources found. Check totolink.net X2000R product page (https://www.totolink.net/home/menu/newstpl/menu_newstpl/products/id/242.html) for newer firmware. Meanwhile, turn off remote/WAN admin, use a strong unique admin password, and keep untrusted devices off the LAN.","status":"open","published_at":"2026-10-20T21:17:16+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:18+00:00","updated_at":"2026-10-23T23:18:03+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: batchupg overflow lets an attacker run code","impact":"high","summary":"A stack-based buffer overflow in the batchupg function of the TOTOLINK X2000R router is triggered by a crafted HTTP request. An attacker who is logged in can run arbitrary code on the device.","category":"infrastructure","who_cares":["totolink","x2000r","router","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the router after logging in","analyst_note":"Find the vendor firmware fix and whether the router web admin is exposed to the internet; check NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-10133.","how_to_check":"Check the router firmware version against TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; the sources do not give a command for checking.","needs_analyst":true,"not_affected_if":["other-models","auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000497,"input_tokens":2953,"output_tokens":403,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor firmware fix and whether the router web admin is exposed to the internet; check NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-10133.","search":"'-10133':13A,16A '-121':42B '-2026':12A,15A '/boafrm/formbuploadsetting':50B '0.0':118C '13977':60B '9.1':44B 'admin':47B 'arbitrari':128C 'attack':8A,132C 'authent':46B,136C 'b20250421.1327':119C 'base':100C 'batchupg':4A,34B,52B,107C 'binari':36B 'broadcast':57B,73B 'buffer':30B,70B,101C 'code':10A,77B,129C 'control':87B 'counter':91B 'craft':62B,122C 'crash':85B 'csid':65B 'cve':11A,14A 'cvss':43B 'cwe':41B 'execut':78B,130C 'exist':104C 'field':66B 'firmware':19A 'function':108C 'gh':116C 'give':76B 'helper':35B 'host':26B 'http':123C,137C 'infrastructur':20B 'iot':21B 'known':96B 'lead':126C 'let':6A 'listen':54B 'make':134C 'overflow':5A,31B,67B,102C 'packet':63B 'patch':94B 'port':59B 'post':48B 'program':90B 'rce':22B 'reach':83B 'request':124C,138C 'resp':74B 'router':3A,23B,81B 'run':9A 'self':25B 'self-host':24B 'send':72B 'special':121C 'stack':29B,69B,99C 'stack-bas':98C 'start':51B 'talo':82B 'totolink':1A,17A,27B,39B,114C 'totolink-x2000r-gh-v1':113C 'trigger':140C 'udp':56B 'v1':117C 'vendor':93B 'version':111C 'vulner':103C,142C 'x2000r':2A,18A,28B,40B,110C,115C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10133","severity":null,"published_at":"2026-10-20T21:17:16+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10133:411","url":null,"severity":null,"published_at":"2026-10-23T23:18:03+00:00","modified_at":"2026-10-23T23:18:03+00:00","first_seen_at":"2026-10-23T23:18:03+00:00","fetched_at":"2026-10-23T23:18:03+00:00","note":"Primary source Talos TALOS-2026-2434 (Lilith Wyatt, disclosed 2026-10-20) plus CVE record. Only build B20250421.1327 listed; no vendor fix or advisory found; no X posts, no public PoC link (Talos gives a trigger sketch), not in KEV."}],"documents":[{"id":1875,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2434","title":"TALOS-2026-2434 Totolink X2000R batchupg stack-based buffer overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1878,"url":"https://www.cve.org/CVERecord?id=CVE-2026-10133","title":"CVE Record: CVE-2026-10133","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}