{"id":"CVE-2026-33568","kind":"vulnerability","aliases":["CVE-2026-33568"],"related":[],"title":"TOTOLINK X2000R router: crafted request runs OS commands as admin","description":"A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Totolink X2000R firmware B20250421.1327: the boa web server's formMapDelDevice handler passes the macstr POST parameter unsanitized into a system() call in /bin/map_del_device. An attacker with admin login can run arbitrary OS commands as root on the router. CVSS 9.1 (PR:H). No vendor fix published as of Oct 2026.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","infrastructure","router","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","other-firmware-versions"],"how_to_check":"In the router admin UI, System/Status page, read the firmware version; TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable. Also check if the admin UI answers from the internet (remote management / WAN port 80 or 8080 enabled) with an external port scan of your WAN IP.","fix":"No fixed firmware known; Talos reports no vendor patch. Until one ships: turn off remote (WAN) web management, use a strong unique admin password, keep the admin UI on a trusted LAN only, and watch totolink.net X2000R download page for a newer build.","status":"open","published_at":"2026-10-20T21:17:18+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:12+00:00","updated_at":"2026-10-23T23:15:48+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: crafted request runs OS commands as admin","impact":"high","summary":"The TOTOLINK X2000R router's Boa web server passes the macstr value of its formMapDelDevice handler to a shell without sanitizing it. An attacker who holds a valid login can send a crafted HTTP request and run arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","router","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Code runs as root on the router; traffic and devices behind it exposed.","analyst_note":"Find the vendor firmware fix version and whether the web admin interface is reachable from WAN; check https://nvd.nist.gov/vuln/detail/CVE-2026-33568 for updates.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","other-firmware-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000485,"input_tokens":2955,"output_tokens":378,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor firmware fix version and whether the web admin interface is reachable from WAN; check https://nvd.nist.gov/vuln/detail/CVE-2026-33568 for updates.","search":"'-2026':12A,15A '-33568':13A,16A '/bin/map_del_device':50B '0.0':99C '2026':77B '9.1':67B 'admin':10A,54B 'arbitrari':58B,109C 'attack':52B,113C 'authent':117C 'b20250421.1327':31B,100C 'boa':33B,86C 'call':48B 'code':110C 'command':8A,19B,60B,80C 'command-inject':18B 'craft':4A,103C 'cve':11A,14A 'cvss':66B 'execut':111C 'exist':83C 'firmwar':30B 'fix':72B 'formmapdeldevic':37B,87C 'function':89C 'gh':97C 'h':69B 'handler':38B 'host':25B 'http':104C,118C 'infrastructur':21B 'inject':20B,81C 'lead':107C 'login':55B 'macstr':41B,88C 'make':115C 'oct':76B 'os':7A,59B,79C 'paramet':43B 'pass':39B 'post':42B 'pr':68B 'publish':73B 'request':5A,105C,119C 'root':62B 'router':3A,22B,65B 'run':6A,57B 'self':24B 'self-host':23B 'server':35B 'special':102C 'system':47B 'totolink':1A,26B,28B,95C 'totolink-x2000r-gh-v1':94C 'trigger':121C 'unsanit':44B 'v1':98C 'vendor':71B 'version':92C 'vulner':82C,123C 'web':34B 'x2000r':2A,17A,27B,29B,91C,96C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-33568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33568","severity":null,"published_at":"2026-10-20T21:17:18+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-33568:403","url":null,"severity":null,"published_at":"2026-10-23T23:15:48+00:00","modified_at":"2026-10-23T23:15:48+00:00","first_seen_at":"2026-10-23T23:15:48+00:00","fetched_at":"2026-10-23T23:15:48+00:00","note":"Read Talos TALOS-2026-2391 (primary, Oct 20 2026): authenticated OS command injection, macstr from formMapDelDevice goes via sprintf into system() in /bin/map_del_device. No vendor fix: Talos timeline shows vendor acknowledged 2026-06-25, no patch by 2026-09-15. No exploit or PoC public (VulDB, KEV false); WAN reachability of admin UI not stated by any source. Siblings: other X2000R boa CVEs (e.g. CVE-2026-41223 same handler, stack overflow). No social discussion searched."}],"documents":[{"id":1862,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2391","title":"TALOS-2026-2391 Totolink X2000R formMapDelDevice macstr OS command injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1864,"url":"https://www.cve.org/CVERecord?id=CVE-2026-33568","title":"CVE Record: CVE-2026-33568","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}