{"id":"CVE-2026-9817","kind":"vulnerability","aliases":["CVE-2026-9817"],"related":[],"title":"TOTOLINK X2000R router: upload handler overflow lets authenticated attacker run code","description":"A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Stack overflow in the boa web server's /boafrm/formUploadFile on TOTOLINK X2000R: the multipart filename is copied with sprintf into a 0xc8-byte stack buffer with no length check. An attacker logged in to the admin interface can send a crafted upload and get code execution as the boa process (crash shows control of the return address). CVSS 9.1 (PR:H). Found by Cisco Talos; vendor acknowledged but no patched firmware is published as far as sources show.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["buffer-overflow","embedded-firmware","infrastructure","router","totolink","x2000r"],"not_affected_if":["auth-required","no-web-admin-exposure","other-firmware-version","wan-admin-disabled"],"how_to_check":"In the router admin UI (System / firmware info) read the firmware version. Vulnerable if it is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Also check whether the admin interface is reachable from WAN or untrusted LAN/Wi-Fi.","fix":"No fixed firmware known. Check totolink.net X2000R downloads (https://www.totolink.net/home/menu/newstpl/menu_newstpl/products/id/242.html) for a build newer than B20250421.1327. Until then: disable remote/WAN admin, restrict the admin UI to a trusted LAN, change the default admin password, and replace the device if it must be exposed.","status":"open","published_at":"2026-10-20T21:17:22+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:02+00:00","updated_at":"2026-10-23T23:11:30+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: upload handler overflow lets authenticated attacker run code","impact":"high","summary":"The boa web server's formUploadFile handler on the TOTOLINK X2000R router has a stack-based buffer overflow triggered by a crafted HTTP request. An attacker with valid login credentials can get arbitrary code execution on the router.","category":"infrastructure","who_cares":["totolink","x2000r","router","embedded-firmware"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs code on the router with full device control.","analyst_note":"Find out whether a vendor firmware fix exists and which firmware versions are patched; check the NVD entry and TOTOLINK's support site for X2000R.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-firmware-version","no-web-admin-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000478,"input_tokens":2963,"output_tokens":364,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find out whether a vendor firmware fix exists and which firmware versions are patched; check the NVD entry and TOTOLINK's support site for X2000R.","search":"'-2026':13A,16A '-9817':14A,17A '/boafrm/formuploadfile':37B '0.0':130C '0xc8':51B '0xc8-byte':50B '9.1':88B 'acknowledg':96B 'address':86B 'admin':65B 'arbitrari':140C 'attack':9A,60B,144C 'authent':8A,148C 'b20250421.1327':131C 'base':111C 'boa':33B,78B,118C 'buffer':20B,54B,112C 'buffer-overflow':19B 'byte':52B 'check':58B 'cisco':93B 'code':11A,74B,141C 'control':82B 'copi':45B 'craft':70B,134C 'crash':80B 'cve':12A,15A 'cvss':87B 'embed':23B 'embedded-firmwar':22B 'execut':75B,142C 'exist':115C 'far':104B 'filenam':43B 'firmwar':24B,100B 'formuploadfil':119C 'found':91B 'function':120C 'get':73B 'gh':128C 'h':90B 'handler':5A 'http':135C,149C 'infrastructur':25B 'interfac':66B 'lead':138C 'length':57B 'let':7A 'log':61B 'make':146C 'multipart':42B 'overflow':6A,21B,30B,113C 'patch':99B 'pr':89B 'process':79B 'publish':102B 'request':136C,150C 'return':85B 'router':3A,26B 'run':10A 'send':68B 'server':35B 'show':81B,107B 'sourc':106B 'special':133C 'sprintf':47B 'stack':29B,53B,110C 'stack-bas':109C 'talo':94B 'totolink':1A,27B,39B,126C 'totolink-x2000r-gh-v1':125C 'trigger':152C 'upload':4A,71B 'v1':129C 'vendor':95B 'version':123C 'vulner':114C,154C 'web':34B 'x2000r':2A,18A,28B,40B,122C,127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9817","severity":null,"published_at":"2026-10-20T21:17:22+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-9817:386","url":null,"severity":null,"published_at":"2026-10-23T23:11:30+00:00","modified_at":"2026-10-23T23:11:30+00:00","first_seen_at":"2026-10-23T23:11:30+00:00","fetched_at":"2026-10-23T23:11:30+00:00","note":"Talos TALOS-2026-2429 (2026-10-20) is the primary source: only build B20250421.1327 listed; vendor acknowledged 2026-06-25 but no fix or fixed firmware found in Talos timeline or CVE record. Aggregator 'Patched' flag (Feedly) unverified. No PoC beyond a dummy-firmware generator and crash trace in Talos; no exploitation evidence. Sibling X2000R CVEs: 9827, 9869, 9814, 9660."}],"documents":[{"id":1833,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2429","title":"TALOS-2026-2429 Totolink X2000R boa formUploadFile stack-based buffer overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}