{"id":"CVE-2026-9660","kind":"vulnerability","aliases":["CVE-2026-9660"],"related":[],"title":"TOTOLINK X2000R router: stack overflow in formFilter lets attackers run code","description":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.","summary":"Authenticated stack buffer overflow in the boa web server's formFilter handler (vpnPassword parameter) on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A logged-in admin can send a crafted HTTP request and run code on the router. CVSS 9.1 (PR:H, scope changed). Part of a batch of 30 Talos CVEs against this one build, including CVE-2026-10141 (unsigned firmware update), which would let an attacker persist. No fix is published. No exploitation or PoC is known.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["boa","embedded-firmware","infrastructure","routers","totolink","x2000r"],"not_affected_if":["auth-required","no-wan-admin","other-firmware-version"],"how_to_check":"Log in to the router admin UI and read the firmware version. Build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable; earlier builds are untested, so treat them as unknown. From outside the network, confirm the admin web interface is not reachable on the WAN side.","fix":"No fixed firmware published as of 2026-10-23 (unknown). Mitigate: set a long unique admin password, turn off remote/WAN administration, limit admin UI access to management hosts. Install a patched build only from totolink.net once released. If compromise is suspected, reflash from an official image or replace the unit, then rotate Wi-Fi/VPN/PPPoE secrets.","status":"open","published_at":"2026-10-20T21:17:22+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:03+00:00","updated_at":"2026-10-23T23:11:44+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-23T22:39:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"TOTOLINK X2000R router: stack overflow in formFilter lets attackers run code","impact":"high","summary":"TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 have stack-based buffer overflows in the boa web server's formFilter handler, triggered through the vpnPassword parameter. An attacker who holds a valid login can send a crafted HTTP request to execute arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","routers","embedded-firmware"],"confidence":0.7,"needs_auth":"yes","worst_case":"code runs on the router with full device control","analyst_note":"Check the NVD entry and the vendor for a patched X2000R firmware build and the exact admin-interface exposure; the sources give no fix or affected-version range beyond one build.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","other-firmware-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000503,"input_tokens":2995,"output_tokens":406,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor for a patched X2000R firmware build and the exact admin-interface exposure; the sources give no fix or affected-version range beyond one build.","search":"'-10141':91B '-2026':13A,16A,90B '-9660':14A,17A '0.0':51B,134C '30':81B '9.1':71B 'admin':57B 'arbitrari':144C 'attack':9A,99B,148C 'authent':28B,152C 'b20250421.1327':52B,135C 'base':115C 'batch':79B 'boa':20B,34B,122C 'buffer':30B,116C 'build':87B 'chang':75B 'code':11A,66B,145C 'craft':61B,138C 'cve':12A,15A,89B 'cves':83B 'cvss':70B 'deal':161C 'embed':22B 'embedded-firmwar':21B 'execut':146C 'exist':119C 'exploit':106B,112C 'firmwar':23B,45B,93B 'fix':102B 'formfilt':7A,38B,123C 'function':124C 'gh':49B,132C 'h':73B 'handler':39B 'http':62B,139C,153C 'includ':88B 'infrastructur':24B 'known':110B 'lead':142C 'let':8A,97B 'log':55B 'logged-in':54B 'make':150C 'multipl':111C 'one':86B 'overflow':5A,31B,117C 'paramet':41B,165C 'part':76B 'persist':100B 'poc':108B 'pr':72B 'publish':104B 'request':63B,140C,154C 'router':3A,25B,69B 'run':10A,65B 'scope':74B 'send':59B 'server':36B 'special':137C 'stack':4A,29B,114C 'stack-bas':113C 'talo':82B 'totolink':1A,18A,26B,43B,47B,130C 'totolink-x2000r-gh-v1':46B,129C 'trigger':156C 'unsign':92B 'updat':94B 'v1':50B,133C 'version':127C 'vpnpassword':40B,164C 'vulner':118C,158C,160C 'web':35B 'would':96B 'x2000r':2A,19A,27B,44B,48B,126C,131C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9660","severity":null,"published_at":"2026-10-20T21:17:22+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-9660:388","url":null,"severity":null,"published_at":"2026-10-23T23:11:44+00:00","modified_at":"2026-10-23T23:11:44+00:00","first_seen_at":"2026-10-23T23:11:44+00:00","fetched_at":"2026-10-23T23:11:44+00:00","note":"Talos CNA record (cve.org) names only build B20250421.1327; no vendor fix or advisory found, no PoC (VulDB: none; not in KEV). One of 30 Talos X2000R CVEs filed 2026-10-20. Not checked: Talos report page for this CVE, TOTOLINK support site (no fetch)."}],"documents":[{"id":1836,"url":"https://www.cve.org/CVERecord?id=CVE-2026-9660","title":"CVE Record: CVE-2026-9660 (Talos CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1819,"url":"https://cveo.tech/blog/totolink-x2000r-30-cves-talos-cve-2026-10141-en","title":"TOTOLINK X2000R: 30 Critical CVEs Disclosed by Talos","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1835,"url":"https://vuldb.com/vuln/424075","title":"VDB-424075 formFilter vpnPassword stack-based overflow","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}