CVE-2026-9659

Deferred Deferred - Pending Action

Stack-Based Buffer Overflow in TOTOLINK X2000R

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: Talos

Description

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-9659

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	Totolink	TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This is a stack-based buffer overflow vulnerability in the TOTOLINK X2000R router firmware. It exists in the formFilter functionality and can be triggered by a specially crafted HTTP request. The vulnerability is in the vpnUser parameter and allows arbitrary code execution if exploited. An attacker needs to be authenticated to send the malicious request.

Detection Guidance

Detecting this vulnerability requires monitoring HTTP requests targeting the vulnerable formFilter functionality in TOTOLINK X2000R devices. Check for unusually long vpnUser parameter values in HTTP requests to the affected endpoint. Inspect logs for authenticated requests with malformed or excessively long input in the vpnUser field.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary code on the affected device. This could lead to full control of the router, enabling them to intercept network traffic, install malware, or use the device as part of a botnet. Since it requires authentication, attackers may first need to gain access to valid credentials.

Compliance Impact

This vulnerability allows arbitrary code execution via a crafted HTTP request, which could lead to unauthorized access or data breaches. Such breaches may violate GDPR (data protection) and HIPAA (health data security) by exposing sensitive information. The high CVSS score (9.1) indicates severe impact on confidentiality, integrity, and availability.

Mitigation Strategies

Immediately update the TOTOLINK X2000R firmware to the latest patched version if available. If no patch exists, restrict access to the device's web interface from untrusted networks. Monitor and filter HTTP traffic for suspicious requests targeting the formFilter functionality. Consider disabling the affected functionality if updates are not feasible.

Hi! I’m here to help you understand CVE-2026-9659. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...