An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s):… (CVE-2026-9814)

CVE-2026-9814 is an OS command injection vulnerability found in the boa formWizard newPass functionality of the TOTOLINK X2000R router firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. An attacker with authentication privileges can send a crafted HTTP request to trigger arbitrary code execution on the device. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS v3.1 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the device, including control over confidentiality, integrity, and availability of the system.

No patch or official fix information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's management interface to trusted users only and monitor for suspicious authenticated HTTP requests targeting the newPass functionality.