{"id":"CVE-2026-10131","published":"2026-10-20T21:17:15.853","lastModified":"2026-10-23T23:17:41.450","description":"An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2432","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The X2000R router's formPasswordSetup endpoint contains an OS command injection flaw (CWE-78) that allows authenticated attackers to execute arbitrary commands on the device by injecting shell metacharacters into unsanitized input, leading to full system compromise.","exploitability":"Exploitation requires valid authentication credentials and a network-accessible management interface, but is otherwise straightforward due to lack of input sanitization.","blast_radius":"Successful exploitation grants an attacker full control over the router, enabling data exfiltration, lateral movement, persistent backdoor installation, or disruption of network services.","remediation":"Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the fixed version explicitly named in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["command-injection","rce","web","embedded","authenticated"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:50:05.118Z"}}