CVE-2026-9814

A CRITICAL OS command injection vulnerability exists in the boa formWizard newPass functionality of the Totolink X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). An authenticated attacker can trigger arbitrary code execution by sending a specially crafted HTTP request. The root cause i...

EUVD-2026-105335

An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...