{"id":"CVE-2026-9869","kind":"vulnerability","aliases":["CVE-2026-9869"],"related":[],"title":"TOTOLINK X2000R router: crafted request overflows stack and runs code","description":"A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Stack buffer overflow in the boa web server's formTR069Config handler on the TOTOLINK X2000R router. An authenticated admin sends a long 'password' POST parameter to /boafrm/formTR069Config. The value is saved to flash, then copied into a smaller stack buffer, which gives code execution on the router. Talos found it and disclosed it on 2026-10-20 without a vendor patch. It is one of 30 Talos CVEs against the same firmware build.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R firmware","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["firmware","infrastructure","no-patch","router","self-hosted","totolink","x2000r"],"not_affected_if":["admin-not-reachable","different-firmware-version"],"how_to_check":"Open the router admin UI and read the firmware version. Firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable, and earlier builds are probably affected too (not confirmed). Also check that the admin interface is not reachable from the WAN, and that the admin password is not the default.","fix":"No fixed firmware has been published as of 2026-10-23, and the vendor has not responded to Talos. Mitigate instead: turn off WAN remote administration, restrict LAN admin access, set a long unique admin password, and disable TR-069 if unused. Watch totolink.net for new X2000R firmware and install only official images.","status":"open","published_at":"2026-10-20T21:17:23+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:00+00:00","updated_at":"2026-10-23T23:10:20+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: crafted request overflows stack and runs code","impact":"high","summary":"A stack-based buffer overflow in the boa web server's formTR069Config handler on the TOTOLINK X2000R router lets a crafted HTTP request corrupt memory. An attacker who is logged in can run arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","router","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Code runs on the router with full control of the device and its traffic","analyst_note":"Sources give no vendor patch or fixed firmware version; check TOTOLINK's site for an updated X2000R firmware and whether the admin interface is exposed to WAN.","how_to_check":"Check the router firmware version in the admin UI and compare it with TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, the version named in the advisory.\nunknown","needs_analyst":true,"not_affected_if":["different-firmware-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000505,"input_tokens":2961,"output_tokens":417,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give no vendor patch or fixed firmware version; check TOTOLINK's site for an updated X2000R firmware and whether the admin interface is exposed to WAN.","search":"'-10':86B '-20':87B '-2026':12A,15A '-9869':13A,16A '/boafrm/formtr069config':57B '0.0':126C '2026':85B '30':96B 'admin':49B 'arbitrari':136C 'attack':140C 'authent':48B,144C 'b20250421.1327':127C 'base':107C 'boa':36B,114C 'buffer':32B,70B,108C 'build':103B 'code':10A,73B,137C 'copi':65B 'craft':4A,130C 'cve':11A,14A 'cves':98B 'disclos':82B 'execut':74B,138C 'exist':111C 'firmwar':20B,102B 'firmware':19A 'flash':63B 'formtr069config':40B,115C 'found':79B 'function':116C 'gh':124C 'give':72B 'handler':41B 'host':28B 'http':131C,145C 'infrastructur':21B 'lead':134C 'long':52B 'make':142C 'no-patch':22B 'one':94B 'overflow':6A,33B,109C 'paramet':55B 'password':53B 'patch':24B,91B 'post':54B 'request':5A,132C,146C 'router':3A,25B,46B,77B 'run':9A 'save':61B 'self':27B 'self-host':26B 'send':50B 'server':38B 'smaller':68B 'special':129C 'stack':7A,31B,69B,106C 'stack-bas':105C 'talo':78B,97B 'totolink':1A,17A,29B,44B,122C 'totolink-x2000r-gh-v1':121C 'trigger':148C 'v1':125C 'valu':59B 'vendor':90B 'version':119C 'vulner':110C,150C 'web':37B 'without':88B 'x2000r':2A,18A,30B,45B,118C,123C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9869","severity":null,"published_at":"2026-10-20T21:17:23+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-9869:384","url":null,"severity":null,"published_at":"2026-10-23T23:10:20+00:00","modified_at":"2026-10-23T23:10:20+00:00","first_seen_at":"2026-10-23T23:10:20+00:00","fetched_at":"2026-10-23T23:10:20+00:00","note":"Read Talos TALOS-2026-2431 (primary). Authenticated (admin) stack overflow via the password POST parameter, which is written to flash then copied to a stack buffer. No fix: Talos timeline shows the vendor acknowledged on 2026-06-25 and never answered the follow-ups through 2026-09-15. No public PoC or exploitation found. One of 30 Talos CVEs on the same firmware. I did not search social posts."}],"documents":[{"id":1818,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2431","title":"TALOS-2026-2431 Totolink X2000R boa formTR069Config stack overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1819,"url":"https://cveo.tech/blog/totolink-x2000r-30-cves-talos-cve-2026-10141-en","title":"TOTOLINK X2000R: 30 Critical CVEs Disclosed by Talos","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}