CVE-2026-33568

Summary

The X2000R router's formMapDelDevice function contains an OS command injection flaw (CWE-78) that allows authenticated attackers to execute arbitrary commands on the device by injecting shell metacharacters into the macstr parameter via a crafted HTTP request.

Exploitability

Exploitation requires valid authentication credentials due to the PR:H (Privileges Required: High) in the CVSS vector, making it difficult for unauthenticated attackers but feasible for compromised or leaked credentials.

Blast radius

Successful exploitation grants full system compromise with high confidentiality, integrity, and availability impact (C:H/I:H/A:H), potentially enabling complete device takeover, data exfiltration, or use as a pivot point within the local network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the exact version mentioned in the description where the vulnerability was introduced; if no fixed version exists beyond this, disable the formMapDelDevice endpoint and restrict administrative access to trusted IPs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.