Live › vulnerability › CVE-2026-9814
Go to dashboardAuthenticated OS command injection in the boa web server's /boafrm/formWizard handler on the TOTOLINK X2000R. The newPass POST parameter goes unsanitized into sprintf and system(). It only triggers when the router is in Mesh mode (MIB_DO_Mcli=1), which an admin can set from the web portal. The attacker needs admin credentials (CVSS PR:H). Found by Lilith Wyatt of Cisco Talos. The vendor has not published a fix.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| X2000R | vendor | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-9814")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.