{"id":"CVE-2026-40627","published":"2026-10-20T21:17:18.517","lastModified":"2026-10-22T15:31:24.813","description":"An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2388","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Totolink X2000R router's formWsc targetAPSsid functionality contains an OS command injection flaw (CWE-78) that allows authenticated attackers to execute arbitrary commands via crafted HTTP requests, leading to full system compromise.","exploitability":"Exploitation requires valid authentication and a specially crafted HTTP request; no public exploit exists yet, but the high CVSS score indicates low technical barrier once credentials are obtained.","blast_radius":"Successful exploitation grants remote code execution with router privileges, enabling full data exfiltration, device hijacking, or pivot into internal networks.","remediation":"Upgrade to firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later; if no fixed version is available, disable the WSC (Wi-Fi Simple Configuration) feature and restrict access to the /formWsc endpoint to trusted IPs only.","detection":"Monitor HTTP access logs for POST requests to /formWsc containing unexpected shell metacharacters (e.g., ';', '|', '&', '$(') in the targetAPSsid parameter, or anomalous command-line process spawns (e.g., 'sh', 'bash', 'wget') from the web server process.","tags":["os-command-injection","rce","web","authentication","iot"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:51:49.321Z"}}