CVE-2026-10137

Received Received - Intake

Stack-Based Buffer Overflow in TOTOLINK X2000R

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Talos

Description

A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-10137

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	Totolink	TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This is a stack-based buffer overflow vulnerability in the boa formUpload() function of TOTOLINK X2000R router firmware (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). It allows arbitrary code execution when an attacker sends a specially crafted HTTP request. The vulnerability requires authentication to exploit.

Impact Analysis

An attacker could gain control of your TOTOLINK X2000R router, potentially intercepting network traffic, installing malware, or using the device as part of a botnet. Since it requires authentication, attackers would need valid credentials or to bypass authentication mechanisms.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy). Organizations using affected devices may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update the TOTOLINK X2000R firmware to the latest patched version to address the stack-based buffer overflow in the formUpload() functionality. If an update is not available, consider disabling the affected HTTP service or restricting access to trusted networks until a fix is applied.

Hi! I’m here to help you understand CVE-2026-10137. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70