CVE-2026-9660

Summary

Stack-based buffer overflow in the formFilter functionality of X2000R's VPN password handling allows authenticated remote attackers to execute arbitrary code by sending a malicious HTTP request with an oversized vpnPassword parameter.

Exploitability

Exploitation requires valid authentication and a single crafted HTTP request; no user interaction is needed, but the attacker must already have valid credentials.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) on the vulnerable device, potentially enabling pivot to internal networks if the device resides in a trusted zone.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the fixed version explicitly named in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.