CVE-2026-10141

Deferred Deferred - Pending Action

Unsigned Firmware Update in TOTOLINK X2000R

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: Talos

Description

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-10141

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	Totolink	TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability is an unsigned firmware issue in the TOTOLINK X2000R device. It allows an attacker to upload a specially crafted firmware binary through an authenticated HTTP request, which can then perform an arbitrary firmware update without proper validation.

Detection Guidance

Detecting this vulnerability requires checking for unsigned firmware updates in TOTOLINK X2000R devices. Monitor HTTP traffic for firmware update requests to the device. Verify if firmware updates are properly signed by the vendor. Check logs for unauthenticated or unexpected firmware update attempts.

Impact Analysis

An attacker could exploit this to install malicious firmware on your device, gaining control over its operations. This could lead to unauthorized access, data theft, or disruption of device functionality.

Compliance Impact

This vulnerability allows arbitrary firmware updates via authenticated HTTP requests, which could enable unauthorized access or control of the device. For GDPR, this may violate data protection requirements if the device processes personal data. For HIPAA, it could compromise the integrity of medical devices or systems handling protected health information.

Mitigation Strategies

Immediately update the firmware to the latest patched version if available. Disable unauthenticated HTTP firmware update functionality if possible. Restrict network access to the device's web interface to trusted IPs only. Monitor for unusual firmware update requests or changes.

Hi! I’m here to help you understand CVE-2026-10141. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...