{"id":"CVE-2026-10139","kind":"vulnerability","aliases":["CVE-2026-10139"],"related":[],"title":"TOTOLINK X2000R router: stack overflow in Mcli lets an attacker run code","description":"A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Authenticated stack overflow in the Mcli helper binary of TOTOLINK X2000R firmware B20250421.1327. In formUpload, attacker-supplied devicemac%d POST parameters (mesh upgrade mode) are put into a system() command line for Mcli, which strcpy's them into 0x12-byte stack buffers. An admin-level session can get code execution as root. CVSS 9.1 (Talos), PR:H.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["infrastructure","routers","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","no-wan-admin"],"how_to_check":"Open the router admin page (Status/System info) and read the firmware version. TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable. Also check whether the admin web UI (port 80/boa) is reachable from WAN or untrusted LAN/guest networks.","fix":"No fixed firmware published in the sources; unknown. Check totolink.net X2000R product page for newer firmware. Until then: disable WAN/remote management, use a strong unique admin password, keep the admin UI off guest and IoT networks.","status":"open","published_at":"2026-10-20T21:17:16+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:15+00:00","updated_at":"2026-10-23T23:16:54+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: stack overflow in Mcli lets an attacker run code","impact":"high","summary":"A stack-based buffer overflow in the Mcli function of the TOTOLINK X2000R router firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) can be triggered by a crafted HTTP request. Successful exploitation gives an attacker arbitrary code execution on the device.","category":"infrastructure","who_cares":["totolink","x2000r","routers","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs code on the router after logging in","analyst_note":"Check the vendor (TOTOLINK) for a firmware fix and confirm whether the web admin interface is reachable from the internet; the sources do not give a fixed version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000486,"input_tokens":2954,"output_tokens":382,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor (TOTOLINK) for a firmware fix and confirm whether the web admin interface is reachable from the internet; the sources do not give a fixed version.","search":"'-10139':15A,18A '-2026':14A,17A '0.0':109C '0x12':68B '0x12-byte':67B '9.1':84B 'admin':74B 'admin-level':73B 'arbitrari':119C 'attack':10A,44B,123C 'attacker-suppli':43B 'authent':28B,127C 'b20250421.1327':40B,110C 'base':91C 'binari':35B 'buffer':71B,92C 'byte':69B 'code':12A,79B,120C 'command':58B 'craft':113C 'cve':13A,16A 'cvss':83B 'd':47B 'devicemac':46B 'execut':80B,121C 'exist':95C 'firmwar':39B 'formupload':42B 'function':99C 'get':78B 'gh':107C 'h':87B 'helper':34B 'host':25B 'http':114C,128C 'infrastructur':21B 'lead':117C 'let':8A 'level':75B 'line':59B 'make':125C 'mcli':7A,33B,61B,98C 'mesh':50B 'mode':52B 'overflow':5A,30B,93C 'paramet':49B 'post':48B 'pr':86B 'put':54B 'request':115C,129C 'root':82B 'router':3A,22B 'run':11A 'self':24B 'self-host':23B 'session':76B 'special':112C 'stack':4A,29B,70B,90C 'stack-bas':89C 'strcpi':63B 'suppli':45B 'system':57B 'talo':85B 'totolink':1A,19A,26B,37B,105C 'totolink-x2000r-gh-v1':104C 'trigger':131C 'upgrad':51B 'v1':108C 'version':102C 'vulner':94C,133C 'x2000r':2A,20A,27B,38B,101C,106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10139","severity":null,"published_at":"2026-10-20T21:17:16+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10139:406","url":null,"severity":null,"published_at":"2026-10-23T23:16:54+00:00","modified_at":"2026-10-23T23:16:54+00:00","first_seen_at":"2026-10-23T23:16:54+00:00","fetched_at":"2026-10-23T23:16:54+00:00","note":"Read Talos TALOS-2026-2439 (primary, truncated before vendor timeline) and NVD. Authenticated (PR:H) only; no fixed firmware named anywhere; no X posts; no public exploit or exploitation seen. Sibling X2000R CVEs share the same firmware."}],"documents":[{"id":1867,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2439","title":"TALOS-2026-2439 Totolink X2000R Mcli stack-based buffer overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1868,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10139","title":"NVD CVE-2026-10139","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}