CVE-2026-40627

Summary

The Totolink X2000R router's formWsc targetAPSsid functionality contains an OS command injection flaw (CWE-78) that allows authenticated attackers to execute arbitrary commands via crafted HTTP requests, leading to full system compromise.

Exploitability

Exploitation requires valid authentication and a specially crafted HTTP request; no public exploit exists yet, but the high CVSS score indicates low technical barrier once credentials are obtained.

Blast radius

Successful exploitation grants remote code execution with router privileges, enabling full data exfiltration, device hijacking, or pivot into internal networks.

Detection

Monitor HTTP access logs for POST requests to /formWsc containing unexpected shell metacharacters (e.g., ';', '|', '&', '$(') in the targetAPSsid parameter, or anomalous command-line process spawns (e.g., 'sh', 'bash', 'wget') from the web server process.

Prioritized remediation

Upgrade to firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later; if no fixed version is available, disable the WSC (Wi-Fi Simple Configuration) feature and restrict access to the /formWsc endpoint to trusted IPs only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.