CVE-2026-40627
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of…
- Risk score
- 67/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 1.0%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R, allowing an attacker to execute arbitrary code via a specially crafted HTTP request.
- Affected
- {'products': ['Totolink X2000R'], 'packages': [], 'versions': ['TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327']}
- Fix
- Check the linked advisory for a fix, as none is specified in the record.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
References
Original description
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Last activity 20 Oct 2026. Patch Forecast updates every hour.