{"id":"CVE-2026-10141","published":"2026-10-20T21:17:16.843","lastModified":"2026-10-23T23:17:42.280","description":"A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerability.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2440","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The X2000R device's firmware update feature lacks cryptographic verification of firmware signatures, allowing an authenticated attacker to install arbitrary firmware by submitting a specially crafted binary.","exploitability":"Exploitation requires valid authenticated HTTP access (high-privilege credentials) and knowledge of the firmware update endpoint; no public exploit exists.","blast_radius":"Successful exploitation enables full device compromise, including persistent backdoor installation, data exfiltration, and use as a pivot point within the network.","remediation":"Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, which implements firmware signature verification; if no fixed version is available, disable the firmware update feature and restrict access to the endpoint.","detection":"Monitor for HTTP POST requests to the firmware update endpoint with unusually large or malformed binary payloads from authenticated sessions; inspect server logs for non-standard firmware file checksums or missing signature metadata.","tags":["firmware-update","auth-bypass","cwe-347","iot","signature-validation"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:50:59.245Z"}}