{"id":"CVE-2026-9814","published":"2026-10-20T21:17:22.773","lastModified":"2026-10-23T23:19:50.850","description":"An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2428","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The X2000R router's formWizard newPass endpoint allows authenticated users to inject and execute arbitrary OS commands via a specially crafted HTTP request due to insufficient input sanitization (CWE-78), enabling full system compromise.","exploitability":"Exploitation requires valid administrative credentials and network access to the vulnerable endpoint; no public exploit exists, but the vulnerability is straightforward to trigger once authenticated.","blast_radius":"Successful exploitation grants attackers full control of the device, enabling data exfiltration, pivot to internal networks, or persistent backdoor installation.","remediation":"Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the fixed version explicitly named in the description.","detection":"Monitor for HTTP POST requests to /formWizard with an unusually long or shell-metacharacter-laden 'newPass' parameter value in web server or application logs; look for subsequent execution of unexpected processes (e.g., /bin/sh, wget, curl) in system logs.","tags":["command-injection","rce","web","router","authenticated"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:46:18.249Z"}}