CVE-2026-10136

Summary

A heap-based buffer overflow in the formUpload() function of the X2000R router's web interface allows authenticated attackers to execute arbitrary code by sending a specially crafted HTTP request, leading to full system compromise including confidentiality, integrity, and availability impacts.

Exploitability

Exploitation requires valid authentication credentials due to the PR:H (Privileges Required: High) in the CVSS vector, making it difficult for unauthenticated attackers but feasible for compromised or leaked credentials.

Blast radius

Successful exploitation grants full remote code execution with system-level privileges on the vulnerable device, enabling complete takeover of the router and potential lateral movement within the internal network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the exact version listed in the description where the vulnerability is present; no fixed version is stated beyond this build.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.