{"id":"CVE-2026-10138","kind":"vulnerability","aliases":["CVE-2026-10138"],"related":[],"title":"TOTOLINK X2000R router: crafted upload request runs OS commands","description":"A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"In the TOTOLINK X2000R boa web server, formUpload() builds an Mcli shell command from the devicemac%d POST parameters (only when easy-mesh mode is on) and runs it with system() without sanitising. An authenticated attacker gets root-level command execution on the router. CVSS 9.1 (Talos). No vendor fix is published; Talos disclosed after three months of follow-ups.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["auth-required-rce","home-router","infrastructure","soho","totolink-x2000r"],"not_affected_if":["auth-required","managed-hosting","wan-management-disabled"],"how_to_check":"Open the router admin page and read the firmware version. TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable; other builds are untested, so treat them as unknown. Exploitation needs a login to /boafrm/formLogin; the Talos code path also needs easy-mesh enabled (or settable by the attacker). Check if the admin UI answers from the WAN side.","fix":"No fixed firmware as of 2026-10-23 (none named by Talos, NVD or TOTOLINK). Mitigate: disable WAN/remote management, change the default admin password, turn off easy-mesh if unused, keep the admin UI on a trusted LAN only, and watch the TOTOLINK X2000R download page for a newer build.","status":"open","published_at":"2026-10-20T21:17:16+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:15+00:00","updated_at":"2026-10-23T23:16:58+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown; no patched firmware version is named in the sources. Restrict access to the router admin interface to trusted hosts and change default admin credentials until a vendor fix is confirmed.","reach":"network","title":"TOTOLINK X2000R router: crafted upload request runs OS commands","impact":"high","summary":"The web management interface of the TOTOLINK X2000R router, in its boa formUpload() handler, passes request input to an OS shell without sanitising it. An attacker who holds a valid login can send a crafted HTTP request and run arbitrary code on the router.","category":"infrastructure","who_cares":["totolink-x2000r","home-router","soho"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as root on the router.","analyst_note":"Find the vendor advisory or firmware changelog for a fixed TOTOLINK X2000R build and confirm which versions are affected; check whether the admin interface is reachable from WAN by default.","how_to_check":"Check the firmware version on the router's admin page against TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; unknown whether other builds are affected.","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000534,"input_tokens":2948,"output_tokens":479,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or firmware changelog for a fixed TOTOLINK X2000R build and confirm which versions are affected; check whether the admin interface is reachable from WAN by default.","search":"'-10138':12A,15A '-2026':11A,14A '0.0':113C '9.1':77B 'arbitrari':123C 'attack':66B,127C 'auth':19B 'auth-required-rc':18B 'authent':65B,131C 'b20250421.1327':114C 'boa':34B,101C 'build':38B 'code':124C 'command':9A,42B,71B,95C 'craft':4A,117C 'cve':10A,13A 'cvss':76B 'd':46B 'devicemac':45B 'disclos':85B 'easi':52B 'easy-mesh':51B 'execut':72B,125C 'exist':98C 'fix':81B 'follow':91B 'follow-up':90B 'formupload':37B,102C 'function':103C 'get':67B 'gh':111C 'home':23B 'home-rout':22B 'http':118C,132C 'infrastructur':25B 'inject':96C 'lead':121C 'level':70B 'make':129C 'mcli':40B 'mesh':53B 'mode':54B 'month':88B 'os':8A,94C 'paramet':48B 'post':47B 'publish':83B 'rce':21B 'request':6A,119C,133C 'requir':20B 'root':69B 'root-level':68B 'router':3A,24B,75B 'run':7A,58B 'sanitis':63B 'server':36B 'shell':41B 'soho':26B 'special':116C 'system':61B 'talo':78B,84B 'three':87B 'totolink':1A,16A,28B,32B,109C 'totolink-x2000r':27B 'totolink-x2000r-gh-v1':108C 'trigger':135C 'up':92B 'upload':5A 'v1':112C 'vendor':80B 'version':106C 'vulner':97C,137C 'web':35B 'without':62B 'x2000r':2A,17A,29B,33B,105C,110C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10138","severity":null,"published_at":"2026-10-20T21:17:16+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10138:407","url":null,"severity":null,"published_at":"2026-10-23T23:16:58+00:00","modified_at":"2026-10-23T23:16:58+00:00","first_seen_at":"2026-10-23T23:16:58+00:00","fetched_at":"2026-10-23T23:16:58+00:00","note":"Read Talos TALOS-2026-2438 (primary): only build B20250421.1327 confirmed; no fix, vendor acked 2026-06-25 but silent through 2026-09-15. No PoC link or exploitation found; social not searched (no CVE-id chatter expected). WAN default exposure not documented."}],"documents":[{"id":1871,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2438","title":"TALOS-2026-2438 Totolink X2000R boa formUpload() OS command injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1872,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10138","title":"NVD CVE-2026-10138","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}