CVE-2026-9817

Summary

A stack-based buffer overflow in the formUploadFile functionality of the X2000R router allows authenticated attackers to overwrite stack memory via a malicious HTTP request, potentially leading to arbitrary code execution.

Exploitability

Exploitation requires valid authentication and sending a specially crafted HTTP request; no public exploit exists yet, making it moderately difficult for adversaries without internal knowledge.

Blast radius

Successful exploitation could allow full compromise of the device, including data exfiltration, device takeover, or use as a pivot point within the local network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later; if that version is not yet available, disable the formUploadFile endpoint and restrict administrative access to trusted IPs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.