{"id":"CVE-2026-35499","kind":"vulnerability","aliases":["CVE-2026-35499"],"related":[],"title":"Totolink X2000R router: crafted request runs OS commands via formWsc","description":"An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Totolink X2000R firmware B20250421.1327 has an OS command injection in the boa web server's /boafrm/formWsc handler. The peerRptPin POST parameter (used when setRptPIN is set and setPIN is empty) is put into a system() call unescaped, so a logged-in admin session can run any command as the router's OS user. CVSS 9.1 (PR:H). Found by Cisco Talos. The vendor acknowledged the report in June 2026, and no fixed firmware has been published.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Totolink X2000R firmware","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"hardware"}],"ecosystems":[],"tags":["command-injection","infrastructure","routers","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","different-firmware-version","managed-hosting","no-web-admin-exposed"],"how_to_check":"Open the router admin page, go to system info/firmware, and compare with TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; that build is the only one confirmed vulnerable. Also check whether the admin web UI is reachable from WAN (remote management enabled, or a port forward to the router's web port) from outside your network.","fix":"No fixed firmware known as of 2026-10-23. Mitigate: disable WAN/remote management, restrict the admin UI to a trusted LAN host, change the default admin password, and check totolink.net for newer X2000R firmware. Consider replacing the device if no patch ships.","status":"open","published_at":"2026-10-20T21:17:18+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:12+00:00","updated_at":"2026-10-23T23:15:48+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Totolink X2000R router: crafted request runs OS commands via formWsc","impact":"high","summary":"The Totolink X2000R router firmware (V1.0.0-B20250421.1327) has an OS command injection flaw in the boa web server's formWsc peerRptPin handler. An attacker who sends a specially crafted HTTP request can run arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","routers","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code as root on the router","analyst_note":"Confirm vendor patch availability and whether the admin interface is reachable from WAN; check the NVD entry for the auth requirement detail.","how_to_check":"Check the firmware version on the router admin page or with the device's system info; the affected build is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","needs_analyst":true,"not_affected_if":["different-firmware-version","no-web-admin-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000505,"input_tokens":2956,"output_tokens":418,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm vendor patch availability and whether the admin interface is reachable from WAN; check the NVD entry for the auth requirement detail.","search":"'-2026':12A,15A '-35499':13A,16A '/boafrm/formwsc':45B '0.0':127C '2026':99B '9.1':85B 'acknowledg':94B 'admin':72B 'arbitrari':137C 'attack':141C 'authent':145C 'b20250421.1327':33B,128C 'boa':41B,115C 'call':65B 'cisco':90B 'code':138C 'command':8A,21B,37B,77B,109C 'command-inject':20B 'craft':4A,131C 'cve':11A,14A 'cvss':84B 'empti':59B 'execut':139C 'exist':112C 'firmwar':32B,103B 'firmware':19A 'fix':102B 'formwsc':10A,116C 'found':88B 'function':118C 'gh':125C 'h':87B 'handler':46B 'host':27B 'http':132C,146C 'infrastructur':23B 'inject':22B,38B,110C 'june':98B 'lead':135C 'log':70B 'logged-in':69B 'make':143C 'os':7A,36B,82B,108C 'paramet':50B 'peerrptpin':48B,117C 'post':49B 'pr':86B 'publish':106B 'put':61B 'report':96B 'request':5A,133C,147C 'router':3A,24B,80B 'run':6A,75B 'self':26B 'self-host':25B 'server':43B 'session':73B 'set':55B 'setpin':57B 'setrptpin':53B 'special':130C 'system':64B 'talo':91B 'totolink':1A,17A,28B,30B,120C,123C 'totolink-x2000r-gh-v1':122C 'trigger':149C 'unescap':66B 'use':51B 'user':83B 'v1':126C 'vendor':93B 'via':9A 'vulner':111C,151C 'web':42B 'x2000r':2A,18A,29B,31B,121C,124C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-35499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35499","severity":null,"published_at":"2026-10-20T21:17:18+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-35499:402","url":null,"severity":null,"published_at":"2026-10-23T23:15:48+00:00","modified_at":"2026-10-23T23:15:48+00:00","first_seen_at":"2026-10-23T23:15:48+00:00","fetched_at":"2026-10-23T23:15:48+00:00","note":"Read Talos TALOS-2026-2387 (primary) and NVD JSON. Authenticated (admin login) command injection: peerRptPin POST param goes unescaped into system() in formWsc. No vendor fix: Zioncom acknowledged 2026-06-25, no patch by Talos's last follow-up 2026-09-15. No PoC link, no exploitation seen, no X chatter. Sibling X2000R CVEs share the same build."}],"documents":[{"id":1861,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2387","title":"TALOS-2026-2387: Totolink X2000R boa formWsc peerRptPin OS command injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1863,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-35499","title":"NVD record CVE-2026-35499","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}