{"id":"CVE-2026-10136","kind":"vulnerability","aliases":["CVE-2026-10136"],"related":[],"title":"TOTOLink X2000R router: heap overflow in upload handler allows code execution","description":"A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Heap overflow in the boa web server on the TOTOLINK X2000R. The filename in a multipart upload to /boafrm/formUpload (or formUploadFile) is copied with a length taken from the input itself, so it can overwrite the heap and run code. It needs an authenticated admin session (CVSS 9.1, PR:H). Talos disclosed it on 2026-10-20 after the vendor stayed silent. No fixed firmware is known.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["embedded","infrastructure","router","totolink","x2000r"],"not_affected_if":["auth-required","other-firmware-versions","wan-admin-disabled","web-admin-disabled"],"how_to_check":"In the router admin UI, open the firmware/status page and read the firmware version. TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable; other builds are untested, so treat them as unknown. Also check whether remote/WAN web management is enabled, and whether the LAN is reachable by untrusted clients.","fix":"No vendor fix published as of 2026-10-23 (checked Talos, CVE record). Mitigate: disable WAN/remote admin, set a strong unique admin password, restrict the admin UI to a trusted LAN host, and watch totolink.net for newer firmware.","status":"open","published_at":"2026-10-20T21:17:16+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:17+00:00","updated_at":"2026-10-23T23:18:02+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLink X2000R router: heap overflow in upload handler allows code execution","impact":"high","summary":"A heap buffer overflow in the boa web server's formUpload() function on the TOTOLINK X2000R router lets a specially crafted HTTP request run code on the device. The attack needs an authenticated session, per the advisory.","category":"infrastructure","who_cares":["totolink","x2000r","router","embedded"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker runs code on the router as an authenticated user","analyst_note":"Confirm whether a vendor firmware fix exists for X2000R beyond build B20250421.1327 and whether the admin interface is exposed to WAN; check the NVD entry for the affected version range.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-firmware-versions","web-admin-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000478,"input_tokens":2957,"output_tokens":364,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether a vendor firmware fix exists for X2000R beyond build B20250421.1327 and whether the admin interface is exposed to WAN; check the NVD entry for the affected version range.","search":"'-10':79B '-10136':14A,17A '-20':80B '-2026':13A,16A '/boafrm/formupload':42B '0.0':113C '2026':78B '9.1':71B 'admin':68B 'allow':9A 'arbitrari':123C 'attack':127C 'authent':67B,131C 'b20250421.1327':114C 'base':94C 'boa':28B,101C 'buffer':95C 'code':10A,63B,124C 'copi':46B 'craft':117C 'cve':12A,15A 'cvss':70B 'disclos':75B 'embed':19B 'execut':11A,125C 'exist':98C 'filenam':36B 'firmwar':88B 'fix':87B 'formupload':102C 'formuploadfil':44B 'function':103C 'gh':111C 'h':73B 'handler':8A 'heap':4A,24B,60B,93C 'heap-bas':92C 'http':118C,132C 'infrastructur':20B 'input':53B 'known':90B 'lead':121C 'length':49B 'make':129C 'multipart':39B 'need':65B 'overflow':5A,25B,96C 'overwrit':58B 'pr':72B 'request':119C,133C 'router':3A,21B 'run':62B 'server':30B 'session':69B 'silent':85B 'special':116C 'stay':84B 'taken':50B 'talo':74B 'totolink':1A,22B,33B,109C 'totolink-x2000r-gh-v1':108C 'trigger':135C 'upload':7A,40B 'v1':112C 'vendor':83B 'version':106C 'vulner':97C,137C 'web':29B 'x2000r':2A,18A,23B,34B,105C,110C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10136","severity":null,"published_at":"2026-10-20T21:17:16+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10136:409","url":null,"severity":null,"published_at":"2026-10-23T23:18:02+00:00","modified_at":"2026-10-23T23:18:02+00:00","first_seen_at":"2026-10-23T23:18:02+00:00","fetched_at":"2026-10-23T23:18:02+00:00","note":"Talos TALOS-2026-2436 (primary) and CVE record read. Only build B20250421.1327 listed; no vendor fix found (vendor notified 2026-06-16, silent since ack 2026-06-25). No public PoC exploit, no exploitation seen, no X chatter. Siblings: CVE-2026-10138, 10135, 9660 same build. WAN exposure of admin UI not stated by sources."}],"documents":[{"id":1874,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2436","title":"TALOS-2026-2436 Totolink X2000R boa formUpload() heap overflow","kind":"advisory","source":"analyst","text":"Talos advisory, 2026-10-20. Vulnerable: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Authenticated. Root cause: get_filename_from_buf strncpy length taken from attacker filename into global upload_filename, heap follows. Reachable via formUpload and formUploadFile. Timeline: vendor notified 2026-06-16, acknowledged 2026-06-25, follow-ups to 2026-09-15; no fix or patch noted.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1877,"url":"https://www.cve.org/CVERecord?id=CVE-2026-10136","title":"CVE Record CVE-2026-10136","kind":"other","source":"analyst","text":"CVSS 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, CWE-122. Affected: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Default status unaffected.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}