{"id":"CVE-2026-40627","kind":"vulnerability","aliases":["CVE-2026-40627"],"related":[],"title":"Totolink X2000R router: crafted request runs OS commands as attacker","description":"An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"The boa web server's formWsc handler on Totolink X2000R routers passes the targetAPSsid parameter to a system shell without sanitising it. An attacker who holds a valid login can send a crafted HTTP request and run arbitrary commands on the router.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Totolink X2000R firmware","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["infrastructure","routers","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","other-firmware","remote-management-disabled"],"how_to_check":"In the router web UI (status/system page) read the firmware version; affected if it is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Check whether the admin web server (boa, ports 80/8080) answers from the WAN side.","fix":"No fixed firmware published as of 2026-10-23 (unknown); check totolink.net downloads for X2000R. Mitigate: turn off remote/WAN management, limit admin UI to trusted LAN, replace the default admin password (exploit needs a valid login).","status":"open","published_at":"2026-10-20T21:17:18+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:10+00:00","updated_at":"2026-10-23T23:14:42+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:39:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Totolink X2000R router: crafted request runs OS commands as attacker","impact":"high","summary":"The boa web server's formWsc handler on Totolink X2000R routers passes the targetAPSsid parameter to a system shell without sanitising it. An attacker who holds a valid login can send a crafted HTTP request and run arbitrary commands on the router.","category":"infrastructure","who_cares":["totolink","x2000r","routers","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs commands as root on the router and takes over the device","analyst_note":"Check the NVD entry and Totolink's vendor advisory for a fixed firmware build and whether the web admin interface is reachable from the internet on affected models.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","other-firmware"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000474,"input_tokens":2958,"output_tokens":356,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and Totolink's vendor advisory for a fixed firmware build and whether the web admin interface is reachable from the internet on affected models.","search":"'-2026':12A,15A '-40627':13A,16A '0.0':89C 'arbitrari':64B,99C 'attack':10A,50B,103C 'authent':107C 'b20250421.1327':90C 'boa':28B,77C 'code':100C 'command':8A,65B,71C 'craft':4A,59B,93C 'cve':11A,14A 'execut':101C 'exist':74C 'firmware':19A 'formwsc':32B,78C 'function':80C 'gh':87C 'handler':33B 'hold':52B 'host':24B 'http':60B,94C,108C 'infrastructur':20B 'inject':72C 'lead':97C 'login':55B 'make':105C 'os':7A,70C 'paramet':41B 'pass':38B 'request':5A,61B,95C,109C 'router':3A,21B,37B,68B 'run':6A,63B 'sanitis':47B 'self':23B 'self-host':22B 'send':57B 'server':30B 'shell':45B 'special':92C 'system':44B 'targetapssid':40B,79C 'totolink':1A,17A,25B,35B,82C,85C 'totolink-x2000r-gh-v1':84C 'trigger':111C 'v1':88C 'valid':54B 'vulner':73C,113C 'web':29B 'without':46B 'x2000r':2A,18A,26B,36B,83C,86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-40627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40627","severity":null,"published_at":"2026-10-20T21:17:18+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-40627:400","url":null,"severity":null,"published_at":"2026-10-23T23:14:42+00:00","modified_at":"2026-10-23T23:14:42+00:00","first_seen_at":"2026-10-23T23:14:42+00:00","fetched_at":"2026-10-23T23:14:42+00:00","note":"CVE.org record, VulDB and Rapid7 read: only build B20250421.1327 listed; no vendor advisory, no fixed firmware, no public PoC (VulDB: none), not in KEV, 0 X posts. Sibling X2000R formWsc CVEs exist (CVE-2026-35499 peerRptPin; older CVE-2025-5504 has a third-party PoC for a different parameter)."}],"documents":[{"id":1852,"url":"https://www.cve.org/CVERecord?id=CVE-2026-40627","title":"CVE Record: CVE-2026-40627","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1853,"url":"https://vuldb.com/vuln/423049","title":"VulDB: Totolink X2000R formWsc os command injection","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}