CVE-2026-10138

Summary

The X2000R router's formUpload() function contains an OS command injection flaw (CWE-78) that allows authenticated attackers to execute arbitrary commands on the device by injecting shell metacharacters into a specially crafted HTTP request.

Exploitability

Exploitation requires valid authentication credentials and a network path to the vulnerable endpoint, but is otherwise straightforward due to lack of input sanitization.

Blast radius

Successful exploitation grants an attacker arbitrary command execution with the privileges of the web server process, potentially enabling full device compromise, data exfiltration, lateral movement, or use as a pivot point.

Detection

Monitor for HTTP POST requests to the /formUpload endpoint containing shell metacharacters (e.g., ;, |, &, $(), backticks) in uploaded filenames or form parameters, especially when combined with unusual file extensions or non-standard content types.

Prioritized remediation

TOTOLINK has not published a fixed version in the description; disable the formUpload() functionality immediately and restrict access to the affected endpoint until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.