← Database

CVE-2026-9827

CRITICAL CVSS: 9.1 Published: 2026-10-20 Modified: 2026-10-20

Description

A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected Platforms

Unknown

Weakness Type

CWE-22

References