CVE-2026-9659
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter…
- Risk score
- 66/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.8%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Multiple stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R, allowing an attacker to execute arbitrary code with an authenticated HTTP request.
- Affected
- {'products': ['X2000R'], 'packages': [], 'versions': ['TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327']}
- Fix
- Check the linked advisory for a fix, as none is provided.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
References
Original description
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.
Last activity 20 Oct 2026. Patch Forecast updates every hour.