VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Oct 20, 2026

CVE-2026-10138

CVE-2026-10138

Description

A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

1
  • Totolink/X2000Rllm-fuzzy
    Range: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.