What’s Vulnerable › Vulnerabilities

CVE-2026-9660

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-23
• Weakness: CWE-121

Description

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.

Affected products

• Totolink: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

References

• https://talosintelligence.com/vulnerability_reports/TALOS-2026-2425

Get alerted when CVE-2026-9660 or the next vulnerability affects your stack