CVE-2026-33568

Deferred Deferred - Pending Action

Authenticated OS Command Injection in TOTOLINK X2000R Router

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: Talos

Description

A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-33568

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	Totolink	TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in the TOTOLINK X2000R router firmware. It exists in the formMapDelDevice macstr functionality and allows arbitrary code execution via a specially crafted HTTP request. An authenticated attacker can exploit this to run unauthorized commands on the device.

Detection Guidance

Detecting this vulnerability requires checking for the presence of TOTOLINK X2000R devices running vulnerable firmware versions. Inspect HTTP requests for the formMapDelDevice macstr parameter in authenticated sessions. Use network scanning tools to identify devices with exposed web interfaces on port 80 or 443.

Impact Analysis

If you use the affected TOTOLINK X2000R router with the vulnerable firmware, an attacker with network access could execute arbitrary code on your device. This could lead to unauthorized control of your router, potential data theft, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR or HIPAA requirements for data protection and access controls. Organizations using the affected device may face compliance violations if exploited.

Mitigation Strategies

Immediately update the TOTOLINK X2000R firmware to the latest patched version. If no patch is available, restrict access to the device's web interface by blocking external connections to ports 80 and 443. Disable unnecessary services and implement network segmentation to limit exposure.

Hi! I’m here to help you understand CVE-2026-33568. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...