{"id":"CVE-2026-9814","kind":"vulnerability","aliases":["CVE-2026-9814"],"related":[],"title":"TOTOLINK X2000R router: crafted HTTP request runs OS commands","description":"An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Authenticated OS command injection in the boa web server's /boafrm/formWizard handler on the TOTOLINK X2000R. The newPass POST parameter goes unsanitized into sprintf and system(). It only triggers when the router is in Mesh mode (MIB_DO_Mcli=1), which an admin can set from the web portal. The attacker needs admin credentials (CVSS PR:H). Found by Lilith Wyatt of Cisco Talos. The vendor has not published a fix.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["boa","command-injection","home-network","infrastructure","router","soho","totolink","x2000r"],"not_affected_if":["different-firmware-build","mesh-mode-off","no-wan-admin","web-admin-not-exposed"],"how_to_check":"Open the router admin page and read the firmware version. Only TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable; other builds are untested. Check whether the admin interface is reachable from WAN (remote management enabled, or the port forwarded). Check whether Mesh mode is enabled.","fix":"No vendor fix or patched version known as of 2026-10-23; check totolink.net for a newer X2000R firmware. Mitigation: turn off remote/WAN management, set a strong unique admin password, limit admin access to trusted LAN hosts, and replace the device if no patch appears.","status":"open","published_at":"2026-10-20T21:17:22+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:03+00:00","updated_at":"2026-10-23T23:11:28+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: crafted HTTP request runs OS commands","impact":"high","summary":"The boa web server's formWizard newPass handler on the TOTOLINK X2000R router passes input to an OS shell without sanitizing it. An attacker who can make an authenticated HTTP request to the admin interface can execute arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","home-network","soho","router"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code as root on the router and controls traffic.","analyst_note":"Confirm the vendor fix version and whether the admin interface is reachable from WAN; the source gives no patch or mitigation, check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9814 and TOTOLINK's site.","how_to_check":"Check the firmware version in the router admin page or via the device label; the affected build is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.\nunknown","needs_analyst":true,"not_affected_if":["different-firmware-build","web-admin-not-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000529,"input_tokens":2954,"output_tokens":467,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the vendor fix version and whether the admin interface is reachable from WAN; the source gives no patch or mitigation, check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9814 and TOTOLINK's site.","search":"'-2026':11A,14A '-9814':12A,15A '/boafrm/formwizard':39B '0.0':121C '1':68B 'admin':71B,81B 'arbitrari':131C 'attack':79B,135C 'authent':29B,139C 'b20250421.1327':122C 'boa':17B,35B,108C 'cisco':91B 'code':132C 'command':9A,19B,31B,102C 'command-inject':18B 'craft':4A,125C 'credenti':82B 'cve':10A,13A 'cvss':83B 'execut':133C 'exist':105C 'fix':99B 'formwizard':109C 'found':86B 'function':111C 'gh':119C 'goe':49B 'h':85B 'handler':40B 'home':22B 'home-network':21B 'http':5A,126C,140C 'infrastructur':24B 'inject':20B,32B,103C 'lead':129C 'lilith':88B 'make':137C 'mcli':67B 'mesh':63B 'mib':65B 'mode':64B 'need':80B 'network':23B 'newpass':46B,110C 'os':8A,30B,101C 'paramet':48B 'portal':77B 'post':47B 'pr':84B 'publish':97B 'request':6A,127C,141C 'router':3A,25B,60B 'run':7A 'server':37B 'set':73B 'soho':26B 'special':124C 'sprintf':52B 'system':54B 'talo':92B 'totolink':1A,27B,43B,117C 'totolink-x2000r-gh-v1':116C 'trigger':57B,143C 'unsanit':50B 'v1':120C 'vendor':94B 'version':114C 'vulner':104C,145C 'web':36B,76B 'wyatt':89B 'x2000r':2A,16A,28B,44B,113C,118C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9814","severity":null,"published_at":"2026-10-20T21:17:22+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-9814:387","url":null,"severity":null,"published_at":"2026-10-23T23:11:28+00:00","modified_at":"2026-10-23T23:11:28+00:00","first_seen_at":"2026-10-23T23:11:28+00:00","fetched_at":"2026-10-23T23:11:28+00:00","note":"Read Talos TALOS-2026-2428 (primary). No vendor fix: Totolink acknowledged 2026-06-25, no patch by 2026-10-20 disclosure. No PoC link, no exploitation (not in KEV, EPSS 1.3%), no X posts. Sibling X2000R CVEs exist (CVE-2026-10138, -9660, -10135) on same build."}],"documents":[{"id":1831,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2428","title":"TALOS-2026-2428 Totolink X2000R formWizard newPass OS command injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1832,"url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-105335","title":"EUVD-2026-105335 (EPSS 1.3%, not in KEV)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}