CVE-2026-10133

Summary

A stack-based buffer overflow in the batchupg functionality of TOTOLINK X2000R allows authenticated remote attackers to execute arbitrary code by sending a specially crafted HTTP request that overflows a local buffer on the stack.

Exploitability

Exploitation requires valid authentication and a network path to the device's HTTP interface; no public exploit exists yet, but the vulnerability is straightforward for an experienced attacker.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) on the affected device, potentially enabling lateral movement within the local network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the fixed version referenced in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.