Key points
- The flaw affects Totolink X2000R firmware version V1.0.0-B20250421.1327.
- CVSS scores the vulnerability at 9.1, classified as critical severity.
- Attackers must hold valid credentials to trigger the issue via HTTP.
Remote attackers with valid login credentials can execute arbitrary code on Totolink X2000R routers. The National Vulnerability Database confirms that a stack-based buffer overflow in the Mcli functionality enables this outcome. This means an intruder can run instructions on the device. The specific firmware version exposed is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Understanding the scope is vital for triage. The risk applies to any system running this specific build.
In plain English
The Mcli functionality contains a memory handling error. When the system processes certain HTTP requests, it encounters a stack-based buffer overflow. This vulnerability allows a specially crafted request to lead to arbitrary code execution. An attacker who holds valid credentials can send this request. The request exploits the flaw to run code on the device. The result is the ability to execute arbitrary commands.
The background
The National Vulnerability Database lists this issue as CVE-2026-10139. It maps to CWE-121, a standard classification for stack-based buffer overflows. The vendor is Totolink. The affected product is the X2000R model. The specific build identified is V1.0.0-B20250421.1327. The Common Vulnerability Scoring System rates the threat at 9.1 out of 10. This score reflects the impact of arbitrary code execution. The requirement for authentication is noted in the description.
What changes now
Service providers must audit their client infrastructure immediately. Any X2000R routers running the identified version are vulnerable. Until a vendor update is available, the exposure remains active. Teams should verify which customers use this specific firmware build. Inventory checks are essential to determine the scale of the problem. Monitoring logs for unusual HTTP traffic may reveal exploitation attempts. Credential security becomes paramount given the authentication requirement.
The attacker's path
Teams usually treat authenticated remote code execution as a high-priority threat. This stage of an intrusion provides attackers with a foothold inside the network perimeter. The weakness lies in how the application handles incoming data without strict boundary checks. Professionals should assess whether exposed administrative interfaces are protected by network segmentation. Check whether multi-factor authentication is enabled for router management portals. Review access logs for suspicious login patterns or unusual request volumes. Isolate affected devices from critical network segments during investigation.
What to do and how to stay safe: Totolink
- Inventory all Totolink X2000R devices and verify their firmware versions.
- Restrict administrative access to the router interface using network segmentation.
- Enforce strong, unique passwords for all router management accounts.
- Monitor network traffic for unusual HTTP requests to the Mcli endpoint.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What does CVE-2026-10139 affect?
It affects the Mcli functionality of Totolink X2000R firmware version V1.0.0-B20250421.1327.
Is the vulnerability remote?
Yes, but the attacker must make an authenticated HTTP request to trigger it.
What is the severity score?
The CVSS score is 9.1, which is classified as critical.
