{"id":"CVE-2026-9659","kind":"vulnerability","aliases":["CVE-2026-9659"],"related":[],"title":"TOTOLINK X2000R router: stack overflow in formFilter lets attacker run code","description":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.","summary":"Authenticated stack buffer overflows in the boa web server's formFilter handler (vpnUser parameter) on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A logged-in admin sending a crafted HTTP request can run code on the router. CVSS 9.1. Part of a batch of ~30 Talos CVEs against this one build. No fix published, no known exploitation or PoC.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["boa","embedded-firmware","infrastructure","router","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","no-admin-web-interface-exposed","no-wan-admin","other-firmware-version","other-firmware-versions"],"how_to_check":"Log in to the router admin UI and read the firmware version. Build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable; other builds are untested (unknown). Confirm the admin web interface is not reachable from the WAN side.","fix":"No fixed firmware published as of 2026-10-23 (unknown). Mitigate: set a long unique admin password, disable remote/WAN administration, restrict admin UI to management hosts. Install a patched build only from totolink.net once released. If compromise is suspected, reflash from an official image or replace the unit and rotate Wi-Fi/VPN/PPPoE secrets.","status":"open","published_at":"2026-10-20T21:17:22+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:03+00:00","updated_at":"2026-10-23T23:12:39+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-23T22:39:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: stack overflow in formFilter lets attacker run code","impact":"high","summary":"TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 have several stack-based buffer overflows in the boa web server's formFilter handler, triggered through the vpnUser parameter. An attacker who sends a crafted HTTP request can execute arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","router","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs code on the router and takes over the network edge","analyst_note":"Confirm whether the web admin interface is reachable from WAN on affected firmware and whether TOTOLINK has published a fixed firmware build; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9659.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-firmware-versions","no-admin-web-interface-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000519,"input_tokens":2991,"output_tokens":440,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the web admin interface is reachable from WAN on affected firmware and whether TOTOLINK has published a fixed firmware build; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9659.","search":"'-2026':13A,16A '-9659':14A,17A '0.0':54B,117C '30':79B '9.1':73B 'admin':60B 'arbitrari':127C 'attack':9A,131C 'authent':31B,135C 'b20250421.1327':55B,118C 'base':98C 'batch':77B 'boa':20B,37B,105C 'buffer':33B,99C 'build':85B 'code':11A,68B,128C 'craft':63B,121C 'cve':12A,15A 'cves':81B 'cvss':72B 'deal':144C 'embed':22B 'embedded-firmwar':21B 'execut':129C 'exist':102C 'exploit':91B,95C 'firmwar':23B,48B 'fix':87B 'formfilt':7A,41B,106C 'function':107C 'gh':52B,115C 'handler':42B 'host':28B 'http':64B,122C,136C 'infrastructur':24B 'known':90B 'lead':125C 'let':8A 'log':58B 'logged-in':57B 'make':133C 'multipl':94C 'one':84B 'overflow':5A,34B,100C 'paramet':44B,148C 'part':74B 'poc':93B 'publish':88B 'request':65B,123C,137C 'router':3A,25B,71B 'run':10A,67B 'self':27B 'self-host':26B 'send':61B 'server':39B 'special':120C 'stack':4A,32B,97C 'stack-bas':96C 'talo':80B 'totolink':1A,18A,29B,46B,50B,113C 'totolink-x2000r-gh-v1':49B,112C 'trigger':139C 'v1':53B,116C 'version':110C 'vpnuser':43B,147C 'vulner':101C,141C,143C 'web':38B 'x2000r':2A,19A,30B,47B,51B,109C,114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9659","severity":null,"published_at":"2026-10-20T21:17:22+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-9659:389","url":null,"severity":null,"published_at":"2026-10-23T23:12:39+00:00","modified_at":"2026-10-23T23:12:39+00:00","first_seen_at":"2026-10-23T23:12:39+00:00","fetched_at":"2026-10-23T23:12:39+00:00","note":"Talos CNA record (cve.org), VulDB and OpenCVE: only build B20250421.1327 named; authenticated (PR:H) per description; no vendor fix/advisory found, no PoC (VulDB: none), not in KEV. Sibling of CVE-2026-9660 (vpnPassword) in a batch of ~30 Talos X2000R CVEs. Not checked: TOTOLINK support site, Talos report page, social posts."}],"documents":[{"id":1842,"url":"https://www.cve.org/CVERecord?id=CVE-2026-9659","title":"CVE Record: CVE-2026-9659 (Talos CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1839,"url":"https://vuldb.com/vuln/424076","title":"VDB-424076 Totolink X2000R formFilter vpnUser stack-based overflow","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1841,"url":"https://app.opencve.io/cve/CVE-2026-9659","title":"OpenCVE CVE-2026-9659","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}