CVE-2026-10139

Summary

A stack-based buffer overflow in the Mcli HTTP endpoint of TOTOLINK X2000R allows authenticated attackers to overwrite stack memory and achieve remote code execution via a malicious request.

Exploitability

Exploitation requires valid authentication and sending a specially crafted HTTP request to the vulnerable Mcli endpoint; no public exploit exists yet, but the high CVSS score indicates low technical barrier once the vector is known.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) on the device, potentially enabling pivot to internal networks or persistent access.

Detection

Monitor for unusually long HTTP POST/GET requests to /mcli or similar Mcli endpoints with excessive header/body lengths exceeding typical CLI command sizes; look for anomalous memory access patterns in firmware logs if available.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later; if no fixed version is available, disable the Mcli HTTP interface and restrict administrative access to trusted IPs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.