{"id":"CVE-2026-10135","published":"2026-10-20T21:17:16.240","lastModified":"2026-10-23T23:17:41.767","description":"A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2435","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The X2000R device's batchupg functionality contains an OS command injection flaw that allows authenticated attackers to execute arbitrary commands on the underlying operating system by injecting shell metacharacters into HTTP requests.","exploitability":"Exploitation requires valid authentication credentials and a specially crafted HTTP request targeting the batchupg endpoint; no public exploit code exists yet.","blast_radius":"Successful exploitation could lead to full system compromise including data exfiltration, malware deployment, or using the device as a pivot point for lateral movement within the network.","remediation":"Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the fixed version explicitly named in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["command-injection","rce","authenticated","firmware","embedded"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:50:26.987Z"}}