Vulnerability · Published Oct 20, 2026 · Assigned by talos

CVE-2026-9659

Critical 9.1

In plain English

A critical-severity stack buffer overflow in Totolink from totolink. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.8%top 43.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.

Affected products (as reported)

Vendor	Product	Versions
totolink	Totolink	TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2425