CVE-2026-9660CWE-121

CVE-2026-9660

Critical · published October 21, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00791 · 55.8th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2026-10-21T01:17Z
References (1)
https://talosintelligence.com/vulnerability_reports/TALOS-2026-2425 · [email protected]
EPSS history
Timeline
  • 22 OCT 03:36Z
    EPSS moved — → 1%
    epss
  • 20 OCT 20:25Z
    Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s)…
    cvelistv5
  • 20 OCT 20:25Z
    Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s)…
    cvelistv5