CVE-2026-35499: OS Command Injection

Published Oct 20, 2026

Updated

An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected Software

1 affected component

TOTOLINK X2000R=TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Event History

Oct 20, 2026

CVE Published

via MITRE·08:25 PM

Data Sourced

via MITRE·08:25 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker must be authenticated to the device's HTTP interface. No user interaction is required, and exploitation can be performed remotely over the network.

What is the likely impact of successful exploitation?

A specially crafted HTTP request can result in arbitrary code execution. The reported impact includes high confidentiality, integrity, and availability impact, and the scope is changed.

Which firmware version is identified as affected?

The issue is reported in TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 for the Totolink X2000R.

CVE-2026-35499: OS Command Injection

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Which firmware version is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Which firmware version is identified as affected?