CVE-2026-10138 | Totolink TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 Boa formUpload os command injection

October 20, 2026 Yanac

A vulnerability was found in Totolink TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and classified as very critical. This issue affects the function formUpload of the component Boa. The manipulation results in os command injection.

This vulnerability is reported as CVE-2026-10138. The attack can be launched remotely. No exploit exists.VulDB Recent EntriesRead More