Totolink X2000R Stack Overflow in boa formUploadFile Permits Authenticated Arbitrary Code Execution

The boa web server component within specific Totolink X2000R firmware contains a stack-based buffer overflow. This flaw resides in the formUploadFile functionality, which processes file uploads via HTTP requests. According to the National Vulnerability Database record for CVE-2026-9817, the weakness allows an attacker to execute arbitrary code on the device. The vulnerability is rated as critical with a CVSS score of 9.1.

Root cause

The underlying issue is a CWE-121 stack-based buffer overflow. This occurs within the boa formUploadFile function when processing a specially crafted HTTP request. The vulnerability exists because the functionality does not adequately handle the input data, leading to a buffer overflow condition. This allows the execution flow to be manipulated by the attacker, resulting in arbitrary code execution on the affected system.

Attack path

An attacker must first obtain valid authentication credentials for the X2000R device. Once authenticated, they can send a specifically crafted HTTP request to the vulnerable form handler. This request triggers the buffer overflow condition within the boa server process. Successful exploitation results in arbitrary code execution on the router, as stated in the vulnerability description.

Affected versions

• Totolink X2000R running firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.

Mitigation

• Restrict administrative access to the device from trusted internal networks only.
• Ensure that strong, unique passwords are used for all administrative accounts.
• Disable the file upload functionality if it is not required for normal operations.
• Monitor for unauthorized changes to network configuration or firmware.

Signals worth monitoring

Security operations teams should inspect web server logs for unusually large POST requests or malformed HTTP headers targeting file upload endpoints. Look for successful authentication events from unusual source IP addresses or at odd hours. Monitor for unexpected outbound connections from the router to external servers, which may indicate command and control activity. Check system logs for process crashes or unusual binary executions that deviate from standard baseline behaviour.

Background: CVSS score

A CVE is a unique identifier for a specific security flaw, acting like a name tag. A CVSS score is a numerical rating of that flaw’s severity. You use the CVE to find the issue and the CVSS score to decide how urgently you must fix it. They serve different functions in your workflow.

Read the full guide: Difference Between CVE and CVSS Score: How to Priorise Remediation

What to do and how to stay safe: Totolink

• Audit current administrative credentials and rotate them immediately if they are weak or shared.
• Review firewall rules to block external access to the device's management interface.
• Isolate the affected device from the main network until a vendor update is available.
• Once the vendor provides an update, apply the patch and verify the firmware version.

Step-by-step guide: File Upload Vulnerabilities: Warning Signs and Immediate Fixes

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-9817?

The vulnerability has a CVSS score of 9.1, which is rated as critical.

Is remote exploitation possible without authentication?

No, the attacker must make an authenticated HTTP request to trigger the vulnerability.

Which specific firmware version is affected?

The issue affects version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 of the X2000R firmware.