{"id":"CVE-2026-10137","kind":"vulnerability","aliases":["CVE-2026-10137"],"related":[],"title":"TOTOLINK X2000R router: stack overflow in upload handler allows code execution","description":"A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Stack buffer overflow in the boa web server's formUpload() on the TOTOLINK X2000R. After login, a long devicemacN POST parameter (used when mesh mode is on) is strcpy'd into a fixed stack buffer with no length check, giving code execution on the router. It needs valid admin credentials (CVSS PR:H). Talos found it and reported it to the vendor on 2026-06-16. The vendor acknowledged it on 2026-06-25, and no patch is listed.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["embedded","infrastructure","routers","totolink","x2000r"],"not_affected_if":["auth-required","no-web-admin-exposure","other-models"],"how_to_check":"Open the router admin page (Status or System) and read the firmware version. TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable. Check whether the web admin is reachable from WAN, for example by scanning your public IP on the admin port (80/8080).","fix":"No fixed firmware published as of 2026-10-23; unknown. Check https://www.totolink.net/home/menu/newstpl/menu_newstpl/products/id/242.html for newer firmware. Until then, turn off remote/WAN administration, restrict the admin UI to LAN, change the default admin password, and avoid untrusted devices on the LAN.","status":"open","published_at":"2026-10-20T21:17:16+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:16+00:00","updated_at":"2026-10-23T23:16:55+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: stack overflow in upload handler allows code execution","impact":"high","summary":"A crafted HTTP request to the boa web server's formUpload() handler on the TOTOLINK X2000R router overflows a stack buffer. An attacker who gets past authentication can run arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","routers","embedded"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker runs arbitrary code on the router after logging in","analyst_note":"No vendor fix or firmware version named in sources; check TOTOLINK for a patched X2000R firmware and whether the admin interface is reachable from the internet.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-models","no-web-admin-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00047,"input_tokens":2958,"output_tokens":349,"severity_before":"critical"},"analyst_status":"done","analyst_note":"No vendor fix or firmware version named in sources; check TOTOLINK for a patched X2000R firmware and whether the admin interface is reachable from the internet.","search":"'-06':89B,97B '-10137':14A,17A '-16':90B '-2026':13A,16A '-25':98B '0.0':126C '2026':88B,96B 'acknowledg':93B 'admin':73B 'allow':9A 'arbitrari':136C 'attack':140C 'authent':144C 'b20250421.1327':127C 'base':107C 'boa':30B,114C 'buffer':26B,59B,108C 'check':63B 'code':10A,65B,137C 'craft':130C 'credenti':74B 'cve':12A,15A 'cvss':75B 'd':54B 'devicemacn':43B 'embed':20B 'execut':11A,66B,138C 'exist':111C 'fix':57B 'formupload':34B,115C 'found':79B 'function':116C 'gh':124C 'give':64B 'h':77B 'handler':8A 'http':131C,145C 'infrastructur':21B 'lead':134C 'length':62B 'list':103B 'login':40B 'long':42B 'make':142C 'mesh':48B 'mode':49B 'need':71B 'overflow':5A,27B,109C 'paramet':45B 'patch':101B 'post':44B 'pr':76B 'report':82B 'request':132C,146C 'router':3A,22B,69B 'server':32B 'special':129C 'stack':4A,25B,58B,106C 'stack-bas':105C 'strcpi':53B 'talo':78B 'totolink':1A,18A,23B,37B,122C 'totolink-x2000r-gh-v1':121C 'trigger':148C 'upload':7A 'use':46B 'v1':125C 'valid':72B 'vendor':86B,92B 'version':119C 'vulner':110C,150C 'web':31B 'x2000r':2A,19A,24B,38B,118C,123C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10137","severity":null,"published_at":"2026-10-20T21:17:16+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10137:408","url":null,"severity":null,"published_at":"2026-10-23T23:16:55+00:00","modified_at":"2026-10-23T23:16:55+00:00","first_seen_at":"2026-10-23T23:16:55+00:00","fetched_at":"2026-10-23T23:16:55+00:00","note":"Read Talos TALOS-2026-2437 (primary). Only firmware B20250421.1327 confirmed vulnerable; no vendor fix: Totolink acknowledged 2026-06-25 but no patch in timeline through 2026-09-15. No PoC or exploitation found; sibling Talos X2000R CVEs (10136, 10138) share formUpload. Did not search social."}],"documents":[{"id":1865,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2437","title":"TALOS-2026-2437: Totolink X2000R boa formUpload() stack-based buffer overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1866,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10137","title":"NVD CVE-2026-10137","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}