---
id: "CVE-2026-9869"
kind: "vulnerability"
aliases: ["CVE-2026-9869"]
title: "TOTOLINK X2000R router: crafted request overflows stack and runs code"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TOTOLINK X2000R firmware", "fixed": [], "affected": "TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327", "ecosystem": "firmware"}]
ecosystems: []
tags: ["firmware", "infrastructure", "no-patch", "router", "self-hosted", "totolink", "x2000r"]
not_affected_if: ["admin-not-reachable", "different-firmware-version"]
published_at: "2026-10-20T21:17:23+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T23:10:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9869", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:10:20+00:00"}]
---

# TOTOLINK X2000R router: crafted request overflows stack and runs code

Stack buffer overflow in the boa web server's formTR069Config handler on the TOTOLINK X2000R router. An authenticated admin sends a long 'password' POST parameter to /boafrm/formTR069Config. The value is saved to flash, then copied into a smaller stack buffer, which gives code execution on the router. Talos found it and disclosed it on 2026-10-20 without a vendor patch. It is one of 30 Talos CVEs against the same firmware build.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:TOTOLINK X2000R firmware affected TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 fixed ?

## How to check

Open the router admin UI and read the firmware version. Firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable, and earlier builds are probably affected too (not confirmed). Also check that the admin interface is not reachable from the WAN, and that the admin password is not the default.

## Fix

No fixed firmware has been published as of 2026-10-23, and the vendor has not responded to Talos. Mitigate instead: turn off WAN remote administration, restrict LAN admin access, set a long unique admin password, and disable TR-069 if unused. Watch totolink.net for new X2000R firmware and install only official images.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-9869
- 2026-10-23T23:10:20+00:00 analyst — Read Talos TALOS-2026-2431 (primary). Authenticated (admin) stack overflow via the password POST parameter, which is written to flash then copied to a stack buffer. No fix: Talos timeline shows the vendor acknowledged on 2026-06-25 and never answered the follow-ups through 2026-09-15. No public PoC or exploitation found. One of 30 Talos CVEs on the same firmware. I did not search social posts.

## Documents

- [advisory] TALOS-2026-2431 Totolink X2000R boa formTR069Config stack overflow https://talosintelligence.com/vulnerability_reports/TALOS-2026-2431
- [mitigation] TOTOLINK X2000R: 30 Critical CVEs Disclosed by Talos https://cveo.tech/blog/totolink-x2000r-30-cves-talos-cve-2026-10141-en

## From the sources

A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_