CVE-2026-10136

Deferred Deferred - Pending Action

Heap-based Buffer Overflow in TOTOLINK X2000R

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: Talos

Description

A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-10136

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	Totolink	TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This is a heap-based buffer overflow in the boa formUpload() function of TOTOLINK X2000R router firmware. It allows an attacker to execute arbitrary code by sending a specially crafted HTTP request. The vulnerability requires authentication but can be triggered remotely.

Detection Guidance

This vulnerability can be detected by monitoring for unusual HTTP requests targeting the formUpload() functionality of TOTOLINK X2000R devices. Check for authenticated HTTP requests with malformed payloads that may trigger heap-based buffer overflows. Inspect network traffic for POST requests to /cgi-bin/formUpload.cgi with unexpected data sizes or patterns.

Impact Analysis

An attacker could gain control of the affected router, steal sensitive data, or use it as a pivot point to attack other devices on the network. Since routers often handle all network traffic, this could lead to widespread compromise of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations if this flaw is exploited.

Mitigation Strategies

Immediately update the TOTOLINK X2000R firmware to the latest patched version. If an update is unavailable, restrict access to the device's web interface via network segmentation or firewall rules. Disable unnecessary services and monitor for suspicious activity. Consider disabling the formUpload() functionality if not required.

Hi! I’m here to help you understand CVE-2026-10136. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...