{"id":"CVE-2026-10138","published":"2026-10-20T21:17:16.597","lastModified":"2026-10-23T23:17:42.077","description":"A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2438","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The X2000R router's formUpload() function contains an OS command injection flaw (CWE-78) that allows authenticated attackers to execute arbitrary commands on the device by injecting shell metacharacters into a specially crafted HTTP request.","exploitability":"Exploitation requires valid authentication credentials and a network path to the vulnerable endpoint, but is otherwise straightforward due to lack of input sanitization.","blast_radius":"Successful exploitation grants an attacker arbitrary command execution with the privileges of the web server process, potentially enabling full device compromise, data exfiltration, lateral movement, or use as a pivot point.","remediation":"TOTOLINK has not published a fixed version in the description; disable the formUpload() functionality immediately and restrict access to the affected endpoint until a patch is available.","detection":"Monitor for HTTP POST requests to the /formUpload endpoint containing shell metacharacters (e.g., ;, |, &, $(), backticks) in uploaded filenames or form parameters, especially when combined with unusual file extensions or non-standard content types.","tags":["rce","command-injection","webapp","embedded","iot"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:45:30.817Z"}}