Totolink X2000R Router Has Critical Command Injection Flaw in Firmware
A critical OS command injection vulnerability in Totolink X2000R firmware allows authenticated attackers to execute arbitrary code via HTTP requests.
Key points
- CVE-2026-35499 carries a CVSS score of 9.1, classified as critical severity.
- The flaw resides in the boa formWsc peerRptPin functionality of the router.
- Attackers must authenticate to trigger arbitrary code execution through HTTP.
The National Vulnerability Database lists CVE-2026-35499 as a critical security flaw affecting Totolink X2000R routers. This operating system command injection vulnerability exists within the device's firmware and allows for arbitrary code execution. The issue stems from improper input handling in a specific web interface component.
At a glance
- CVE
- CVE-2026-35499
- Product
- Totolink
- CVSS
- 9.1 Critical
- Weakness
- OS command injection
- Exploited
- No known exploitation
According to the NVD record, the vulnerability has a CVSS base score of 9.1. This high severity rating reflects the potential for complete system compromise. The weakness is categorized under CWE-78, which denotes improper neutralization of special elements used in an OS command. Exploitation requires an authenticated HTTP request, meaning attackers need valid login credentials.
Technical Context and Impact
The flaw is located in the boa formWsc peerRptPin functionality. This specific module processes requests that can be manipulated by a specially crafted HTTP packet. When an attacker sends this malicious request, the system executes unintended operating system commands. This leads to arbitrary code execution on the router itself.
The affected software version is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. The NVD record explicitly names this firmware build as vulnerable. No other versions or models are mentioned in the current disclosure. Consequently, users of this specific firmware build are the primary concern for this advisory.
Affected Systems and Scope
Only the Totolink X2000R model running the specified firmware version is confirmed to be vulnerable. The NVD entry explicitly names this device and software build. No other Totolink products or different firmware versions are mentioned in the current disclosure. This limits the immediate scope of the threat to owners of this particular configuration.
Authentication is required to exploit the vulnerability. This means an attacker cannot trigger the code execution from the public internet without first bypassing login controls. However, if credentials are compromised or weak, the risk of remote code execution becomes significant. That suggests credential hygiene is a key defense against this specific attack vector.
What should you do?
No patch or firmware update has been confirmed for this vulnerability yet. Users should verify their current firmware version against the affected build number. If the version matches, consider isolating the device from sensitive network segments. Monitor for official statements from Totolink regarding a security fix.
What to do and how to stay safe
- Check your router's firmware version to see if
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
