EUVD-2026-105336

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to...

CVE-2026-9869

A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

CVE-2026-9869

The Totolink X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to a stack-based buffer overflow in the boa binary's formTR069Config() functionality. An authenticated attacker can trigger this by sending a specially crafted HTTP POST request to the /boafrm/formTR069Config pa...

EUVD-2026-105332

A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

EUVD-2026-105330

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

CVE-2026-10133

A stack-based buffer overflow exists in the batchupg functionality of the TOTOLINK X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The vulnerability is triggered when an authenticated user sends a specially crafted HTTP POST request to the /boafrm/formBuploadSetting page. The p...

CVE-2026-10133

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

EUVD-2026-105329

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2026-10135

A OS command injection vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

EUVD-2026-105328

A OS command injection vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2026-10135

A CRITICAL OS command injection vulnerability exists in the batchupg functionality of the Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The root cause stems from a lack of sanitization on the filename parameter across a multi-step data flow: first, it is received via...

CVE-2026-10141

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

CVE-2026-10139

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2026-10139

A stack-based buffer overflow vulnerability exists in the Mcli functionality of the Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). An authenticated attacker can trigger this by sending a specially crafted HTTP request to the /boafrm/formUpload page. The vulnerability ...

EUVD-2026-105324

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

EUVD-2026-105323

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

CVE-2026-10141

The Totolink X2000R (version: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to an Unsigned Firmware flaw in the boa Firmware Update functionality. The root cause is the improper verification of cryptographic signatures (CWE-347); while the system checks for magic bytes and checksums, i...

CVE-2026-111769

In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers such as an "X-API-Key" set in "requestInit.headers" and the...

CVE-2026-87861

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused...

CVE-2026-87861

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused...