VYPR
advisoryPublished Oct 20, 2026· Updated Oct 21, 2026· 1 source

Totolink X2000R: 25 Critical Vulnerabilities Disclosed in Single Batch

Key findings • 25 critical vulnerabilities disclosed on October 20, 2026, for the Totolink X2000R router. • All vulnerabilities have a CVSSv3 score of 9.1 and affect firmware version TOTOLINK…

Key findings

  • 25 critical vulnerabilities disclosed on October 20, 2026, for the Totolink X2000R router.
  • All vulnerabilities have a CVSSv3 score of 9.1 and affect firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.
  • Flaws include stack-based buffer overflows, OS command injection, arbitrary file writes, and unsigned firmware updates.
  • Exploitation requires an authenticated HTTP request, potentially allowing arbitrary code execution.
  • Users should immediately check for and apply firmware updates from Totolink.

On October 20, 2026, a significant batch of 25 critical vulnerabilities was disclosed for the Totolink X2000R router. All vulnerabilities share the same CVSSv3 score of 9.1 and were discovered in the 'boa' web server and 'Mcli' functionalities. These flaws, affecting firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, could allow an authenticated attacker to achieve arbitrary code execution through specially crafted HTTP requests.

The disclosed vulnerabilities span several categories, including stack-based buffer overflows and OS command injections.

Stack-Based Buffer Overflows

Multiple stack-based buffer overflow vulnerabilities were found across various 'boa' functionalities:

OS Command Injection

Several OS command injection vulnerabilities were also identified:

Arbitrary File Write and Unsigned Firmware Update

Additionally, an arbitrary file write vulnerability in formUploadFile (CVE-2026-9827) and an unsigned firmware update vulnerability in the firmware update functionality (CVE-2026-10141) were disclosed.

All identified vulnerabilities require an authenticated HTTP request to be triggered, meaning an attacker would first need to gain some level of access to the router's administrative interface. The consistent disclosure of these critical flaws suggests a potential systemic weakness in the device's web interface implementation.

The affected version for all disclosed vulnerabilities is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Users of the Totolink X2000R are strongly advised to check for and apply any available firmware updates from Totolink to mitigate these critical security risks. As these vulnerabilities allow for arbitrary code execution, successful exploitation could lead to a complete compromise of the affected device.

This batch of 25 critical vulnerabilities underscores the importance of regular security audits and timely patching for network devices, especially those managing internet connectivity for homes and small businesses. Users should remain vigilant for any further advisories or updates from Totolink regarding the X2000R.

Synthesized by Vypr AI