CVE-2026-9827

Deferred Deferred - Pending Action

Arbitrary File Write in TOTOLINK X2000R Router

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: Talos

Description

A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-9827

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	Totolink	TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is an arbitrary file write issue in the boa formUploadFile functionality of TOTOLINK X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. It allows attackers to execute arbitrary code by sending a specially crafted HTTP request. The vulnerability requires authentication to exploit.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized file uploads or suspicious HTTP requests targeting the formUploadFile functionality in TOTOLINK X2000R devices. Monitor network traffic for POST requests to /cgi-bin/formUploadFile with unusual file extensions or paths. Inspect device logs for failed authentication attempts or unexpected file writes.

Impact Analysis

This vulnerability can allow attackers to write arbitrary files to the router's filesystem, potentially leading to full system compromise. Attackers could gain control over the router, steal sensitive data, or use it as a foothold to attack other systems on the network.

Compliance Impact

This vulnerability allows arbitrary file write and code execution via authenticated HTTP requests. Such unauthorized access could lead to data breaches, exposing sensitive information. For GDPR, this may violate principles of data protection and user rights. For HIPAA, it risks unauthorized access to protected health information.

Mitigation Strategies

Immediately update the TOTOLINK X2000R firmware to the latest patched version if available. Disable the formUploadFile functionality if not required. Restrict access to the device's web interface to trusted networks only. Monitor for unauthorized file uploads or suspicious activity.

Hi! I’m here to help you understand CVE-2026-9827. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...