CVE-2026-10132

Summary

A stack-based buffer overflow in the formIpQos MAC functionality of the X2000R router's web interface allows authenticated attackers to overwrite stack memory via a crafted HTTP request, potentially leading to remote code execution.

Exploitability

Exploitation requires valid authentication and sending a specially crafted HTTP request to the affected endpoint; no public exploit exists yet, but the high CVSS score indicates feasibility for skilled attackers.

Blast radius

Successful exploitation could allow an authenticated attacker to execute arbitrary code with root privileges on the device, compromising confidentiality, integrity, and availability of the router and potentially the connected network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the fixed version explicitly named in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.