{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/x2000r--totolink-x2000r-gh-v1.0.0-b20250421.1327/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:totolink:x2000r:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-10131"},{"id":"CVE-2026-10132"},{"id":"CVE-2026-42019"},{"id":"CVE-2026-9827"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["X2000R (\u003c TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327)","X2000R (\u003c= TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327)","X2000R (V1.0.0-B20250421.1327)","X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-10131","command-injection","network-security","totolink","buffer-overflow","router","remote-code-execution","vulnerability","network-device","iot"],"_cs_type":"advisory","_cs_vendors":["TOTOLINK"],"content_html":"\u003cp\u003eTOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) contains an OS command injection vulnerability within the boa formPasswordSetup functionality. This flaw allows an authenticated attacker to inject arbitrary commands into the underlying operating system by sending a specially crafted HTTP request to the web interface. Successful exploitation results in remote code execution, which can be leveraged to gain full control of the affected networking hardware. Given that these devices are typically internet-facing edge infrastructure, this vulnerability represents a significant risk for lateral movement and persistence within a network if an attacker compromises a valid administrative or user credential to gain the necessary authentication context.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full command execution on the router, enabling attackers to intercept traffic, reconfigure network security, or pivot into the internal network environment. This poses a high risk to small office and home office (SOHO) deployments where the X2000R serves as the primary gateway.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web traffic to TOTOLINK X2000R administrative interfaces for suspicious HTTP POST requests containing command delimiters or shell metacharacters.\u003c/li\u003e\n\u003cli\u003eReview all administrative access logs to identify anomalous authentication sessions followed immediately by POST requests to formPasswordSetup.\u003c/li\u003e\n\u003cli\u003ePatch affected X2000R devices by upgrading to a firmware version later than TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 as soon as vendor guidance becomes available.\u003c/li\u003e\n\u003cli\u003eIsolate administrative interfaces of networking hardware from the public internet using firewalls or VPN access control lists.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:52:47Z","date_published":"2026-10-20T21:50:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-10131/","summary":"An OS command injection vulnerability in the TOTOLINK X2000R router allows an authenticated attacker to execute arbitrary system commands via the boa formPasswordSetup function.","title":"TOTOLINK X2000R: OS Command Injection in formPasswordSetup (CVE-2026-10131)","url":"https://feed.craftedsignal.io/briefs/2026-10-10131/"}],"language":"en","title":"CraftedSignal Threat Feed - X2000R (\u003c= TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327)","version":"https://jsonfeed.org/version/1.1"}