External risk intelligence

TOTOLINK X2000R OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-10138

The vulnerability exists in a router (X2000R), which is a network edge device. While the vulnerability requires authentication, the management interfaces of such consumer and small-office networking equipment are frequently exposed to the internet or reachable via the wide area network in common deployment patterns, making them a common target for external network-based interaction.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in the X2000R router's form upload feature. This vulnerability could allow a malicious actor, with existing access, to execute arbitrary code on the device by sending a specially crafted request. The primary concern is to confirm if this specific router model is in use and potentially exposed.

Command execution flaw in router uploads.
Affects network edge devices, a common target.
Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker with existing authenticated access to the device can send a specially crafted HTTP request targeting the `formUpload()` function. This function, when processed, can be manipulated to execute arbitrary operating system commands on the affected device, potentially leading to a full compromise.

Requires authenticated access.
Triggered via a malicious HTTP request.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated attacker to execute arbitrary code on the router by sending a specially crafted HTTP request. This could affect the router's services and potentially its system data.

Router system data at risk.
Achieved via crafted HTTP requests.
Arbitrary code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the TOTOLINK X2000R router's `boa formUpload()` function, requiring authenticated access for exploitation. Network and security teams, along with device owners, should prioritize identifying all deployed X2000R units. Confirming internet exposure and business criticality will dictate immediate mitigation strategies, such as access control adjustments or vendor coordination for firmware updates.

Device owners should investigate exposure and criticality.
Verify authenticated remote access is disabled.
Plan vendor firmware update or device replacement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK X2000R?

The X2000R is a networking device produced by TOTOLINK, typically used as a router in home or small-office environments to manage internet connectivity and local network traffic. As a network edge device, it acts as a gateway, routing data between internal devices and the internet.

What does OS command injection mean for CVE-2026-10138?

This vulnerability, classified as CWE-78 (OS Command Injection), means the software fails to properly sanitize input before passing it to the system shell. In this case, the device interprets a crafted HTTP request as a command, allowing an attacker to run unauthorized operating system instructions on the router.

How is this vulnerability triggered?

The flaw is triggered when the `formUpload()` function processes a specially crafted HTTP request. It is important to note that this is not a public, unauthenticated entry point; the vulnerability specifically requires the attacker to have already established authenticated access to the device to submit the malicious request.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies this as a 'Likely' concern because the X2000R is a network edge device. Even though authentication is required, the management interfaces for this type of hardware are frequently reachable via the internet or wide area networks, increasing the likelihood that they could be targeted.

What should I do if I use the TOTOLINK X2000R?

First, identify all deployed X2000R units in your environment. Prioritize verifying that remote management access is disabled to prevent unauthorized users from reaching the interface. Monitor official vendor channels for firmware updates and evaluate your network configuration to ensure these devices are not unnecessarily exposed.

References

talosintelligence.com/vulnerability_reports/TALOS-2026-2438

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.