CVE-2026-9660: Buffer Overflow

Published Oct 20, 2026

Updated

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.

Affected Software

1 affected component

TOTOLINK X2000R=TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Event History

Oct 20, 2026

CVE Published

via MITRE·08:25 PM

Data Sourced

via MITRE·08:25 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be authenticated to the device's HTTP interface. No user interaction is required, and exploitation is described as possible with a specially crafted HTTP request.

Which systems are known to be affected?

The affected product is the TOTOLINK X2000R, specifically firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.

What is the likely impact of successful exploitation?

Successful exploitation can result in arbitrary code execution. The reported severity vector indicates potential high impact to confidentiality, integrity, and availability, including impact beyond the vulnerable component's security scope.

CVE-2026-9660: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which systems are known to be affected?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which systems are known to be affected?

What is the likely impact of successful exploitation?