CVE-2026-10138

A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R…

Risk score: 68/100
CVSS: 9.1 v3.1
Exploit chance (30 days): 1.2%
Published: 20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R, allowing an attacker to execute arbitrary code with a specially crafted HTTP request.
Affected: {'products': ['TOTOLINK-X2000R-Gh'], 'packages': [], 'versions': ['V1.0.0-B20250421.1327']}
Fix: Check the linked advisory for a fix, as none is provided in the record.
Exploitation: No known exploitation

Why it is Amber

CVSS 9.1 critical

References

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2438

Original description

A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Last activity 20 Oct 2026. Patch Forecast updates every hour.