{"id":"CVE-2026-9827","kind":"vulnerability","aliases":["CVE-2026-9827"],"related":[],"title":"TOTOLINK X2000R router: authenticated file upload lets attackers run code","description":"A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Authenticated path traversal in the boa web server's /boafrm/formUploadFile on the TOTOLINK X2000R. The uploaded filename is not validated, so '../' lets a logged-in user write any root-writable file, which leads to code execution. Talos reported it 2026-06-16; the vendor acknowledged it but no fixed firmware has been published. CVSS 9.1 (PR:H, so admin login is needed).","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","router","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","other-firmware-versions","remote-admin-disabled"],"how_to_check":"Open the router admin page (Status/firmware info) and read the firmware version. Exposed if it is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Also check whether the admin interface (boa, /boafrm/*) is reachable from WAN. Other builds: unknown, not tested by Talos.","fix":"No fixed firmware published as of 2026-10-23 (unknown). Check totolink.net X2000R product page for a newer build. Meanwhile: disable WAN/remote administration, change the default admin password, restrict the admin UI to a trusted LAN segment.","status":"open","published_at":"2026-10-20T21:17:23+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:00+00:00","updated_at":"2026-10-23T23:11:22+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: authenticated file upload lets attackers run code","impact":"high","summary":"The boa web server's formUploadFile handler on the TOTOLINK X2000R router lets an authenticated user write arbitrary files. A crafted HTTP request can turn that into arbitrary code execution on the device.","category":"infrastructure","who_cares":["totolink","x2000r","router","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs code on the router and takes over the device","analyst_note":"Check the TOTOLINK vendor site or the NVD entry for a fixed firmware build and for the exact check of the affected version string TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","other-firmware-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00048,"input_tokens":2955,"output_tokens":368,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the TOTOLINK vendor site or the NVD entry for a fixed firmware build and for the exact check of the affected version string TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","search":"'-06':67B '-16':68B '-2026':12A,15A '-9827':13A,16A '/boafrm/formuploadfile':34B '0.0':109C '2026':66B '9.1':81B 'acknowledg':71B 'admin':85B 'arbitrari':90C,119C 'attack':8A,123C 'authent':4A,25B,127C 'b20250421.1327':110C 'boa':30B,97C 'code':10A,61B,120C 'craft':113C 'cve':11A,14A 'cvss':80B 'execut':62B,121C 'exist':94C 'file':5A,57B,91C 'filenam':41B 'firmwar':76B 'fix':75B 'formuploadfil':98C 'function':99C 'gh':107C 'h':83B 'host':22B 'http':114C,128C 'infrastructur':18B 'lead':59B,117C 'let':7A,46B 'log':49B 'logged-in':48B 'login':86B 'make':125C 'need':88B 'path':26B 'pr':82B 'publish':79B 'report':64B 'request':115C,129C 'root':55B 'root-writ':54B 'router':3A,19B 'run':9A 'self':21B 'self-host':20B 'server':32B 'special':112C 'talo':63B 'totolink':1A,23B,37B,105C 'totolink-x2000r-gh-v1':104C 'travers':27B 'trigger':131C 'upload':6A,40B 'user':51B 'v1':108C 'valid':44B 'vendor':70B 'version':102C 'vulner':93C,133C 'web':31B 'writabl':56B 'write':52B,92C 'x2000r':2A,17A,24B,38B,101C,106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9827","severity":null,"published_at":"2026-10-20T21:17:23+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-9827:385","url":null,"severity":null,"published_at":"2026-10-23T23:11:22+00:00","modified_at":"2026-10-23T23:11:22+00:00","first_seen_at":"2026-10-23T23:11:22+00:00","fetched_at":"2026-10-23T23:11:22+00:00","note":"Read Talos TALOS-2026-2430 (primary). Only build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 confirmed vulnerable; no vendor fix found (vendor acked 2026-06-25, silent since). No public exploit or KEV; no social search done (low-profile CVE). Sibling X2000R CVEs from same Talos batch exist."}],"documents":[{"id":1829,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2430","title":"TALOS-2026-2430: Totolink X2000R boa formUploadFile arbitrary file write","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1830,"url":"https://vuldb.com/vuln/424078","title":"VulDB: Totolink X2000R formUploadFile (CVE-2026-9827)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}