TOTOLINK X2000R: OS Command Injection in formPasswordSetup (CVE-2026-10131)

TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) contains an OS command injection vulnerability within the boa formPasswordSetup functionality. This flaw allows an authenticated attacker to inject arbitrary commands into the underlying operating system by sending a specially crafted HTTP request to the web interface. Successful exploitation results in remote code execution, which can be leveraged to gain full control of the affected networking hardware. Given that these devices are typically internet-facing edge infrastructure, this vulnerability represents a significant risk for lateral movement and persistence within a network if an attacker compromises a valid administrative or user credential to gain the necessary authentication context.

Impact

Successful exploitation allows for full command execution on the router, enabling attackers to intercept traffic, reconfigure network security, or pivot into the internal network environment. This poses a high risk to small office and home office (SOHO) deployments where the X2000R serves as the primary gateway.

Recommendation

• Monitor web traffic to TOTOLINK X2000R administrative interfaces for suspicious HTTP POST requests containing command delimiters or shell metacharacters.
• Review all administrative access logs to identify anomalous authentication sessions followed immediately by POST requests to formPasswordSetup.
• Patch affected X2000R devices by upgrading to a firmware version later than TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 as soon as vendor guidance becomes available.
• Isolate administrative interfaces of networking hardware from the public internet using firewalls or VPN access control lists.