{"id":"CVE-2026-35499","published":"2026-10-20T21:17:18Z","modified":"2026-10-23T23:17:43Z","title":"An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R…","vendor":"totolink","product":"Totolink","tier":"core","eol":null,"description":{"text":"An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","provenance":"source","from":"NVD"},"summary":{"text":"An OS command injection flaw in the boa formWsc peerRptPin functionality of the Totolink X2000R router firmware allows an attacker to inject operating system commands through specially crafted HTTP requests. Exploitation requires network access to the device and an authenticated HTTP session, after which arbitrary code execution can be achieved.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:50Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.01286,"percentile":0.70158,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2387","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-105352","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105352","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35499","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":20.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.03,"detail":"percentile 0.7016"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}