CVE-2026-10131

Summary

The X2000R router's formPasswordSetup endpoint contains an OS command injection flaw (CWE-78) that allows authenticated attackers to execute arbitrary commands on the device by injecting shell metacharacters into unsanitized input, leading to full system compromise.

Exploitability

Exploitation requires valid authentication credentials and a network-accessible management interface, but is otherwise straightforward due to lack of input sanitization.

Blast radius

Successful exploitation grants an attacker full control over the router, enabling data exfiltration, lateral movement, persistent backdoor installation, or disruption of network services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the fixed version explicitly named in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.