CVE-2026-10135

Summary

The X2000R device's batchupg functionality contains an OS command injection flaw that allows authenticated attackers to execute arbitrary commands on the underlying operating system by injecting shell metacharacters into HTTP requests.

Exploitability

Exploitation requires valid authentication credentials and a specially crafted HTTP request targeting the batchupg endpoint; no public exploit code exists yet.

Blast radius

Successful exploitation could lead to full system compromise including data exfiltration, malware deployment, or using the device as a pivot point for lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the fixed version explicitly named in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.