Threat level Severe
Contact
Critical 9.1
CVE-2026-10139

Totolink — remote code execution.

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).

WeaknessCWE-121: Stack buffer overflow
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Exploit chance, 30 days
0.6%
Higher than 49% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

What to do

  1. 01Check whether you run TOTOLINK, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-1146259.9Arista VeloCloud OrchestratorCVE-2026-1114979.8Google Brotli
Vendor
TOTOLINK40 CVEs in 30 days
All TOTOLINK CVEs

Other CVEs in TOTOLINK

29 more CVEs

All TOTOLINK CVEs
9.1Totolink — remote code execution.EPSS 0.6%9.1Totolink — remote code execution.EPSS 0.5%9.1Totolink — remote code execution.EPSS 0.8%9.1Totolink — remote code execution.EPSS 0.5%9.1Totolink — remote code execution.EPSS 1.6%9.1Totolink — remote code execution.EPSS 0.5%