CVE-2026-10138 in Totolink信息

摘要

由 MITRE • 2026-10-21

A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

负责

Talos

预定

2026-05-29

披露

2026-10-21

管理

已接受

条目

VDB-423043

CPE

20261021

CWE

CWE-78 (已确认)

CVSS

9.1 (CNA)

EPSS

0.00000

KEV

否

活动

非常低

来源

MITRE	https://www.cve.org/CVERecord?id=CVE-2026-10138
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-10138
CVE Details	https://www.cvedetails.com/cve/CVE-2026-10138/

◂ 上一步一览下一步 ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!