CVE-2026-35499
CVE-2026-35499
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS 9.1 · Critical · EPSS 1.0%
- Published
- Updated
Affected products and versions
totolink
- Versions
- TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327: Affected
No fix published