CVE-2026-35499

Summary

The Totolink X2000R router's formWsc peerRptPin functionality contains an OS command injection flaw (CWE-78) that allows authenticated attackers to execute arbitrary commands on the device via a malicious HTTP request. This is critical due to the high CVSS score and potential for full system compromise.

Exploitability

Exploitation requires valid authentication credentials, but otherwise has low complexity and no user interaction, making it highly exploitable by compromised accounts or credential theft.

Blast radius

Successful exploitation grants remote code execution with root-level privileges, enabling full device takeover, data exfiltration, lateral movement, and persistent backdoor deployment within the local network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the only fixed version explicitly referenced in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.