CVE-2026-9827

Summary

The X2000R router's formUploadFile functionality contains a path traversal (CWE-22) flaw that allows an authenticated attacker to write arbitrary files on the device, potentially leading to remote code execution by overwriting critical system files.

Exploitability

Exploitation requires valid authentication credentials and sending a specially crafted HTTP request to the vulnerable upload endpoint; high privilege is needed per CVSS PR:H.

Blast radius

Successful exploitation could allow full compromise of the device, including persistence, privilege escalation, and use as a pivot point within the local network.

Detection

Monitor for HTTP POST requests to /formUploadFile containing '..' in the filename parameter or unexpected file paths (e.g., outside /tmp/), especially from authenticated sessions with non-admin roles; also watch for subsequent unexpected file creation or modification in sensitive directories like /etc/ or /bin/.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, which contains the vendor's fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.