{"id":"CVE-2026-9827","published":"2026-10-20T21:17:23Z","modified":"2026-10-23T23:19:51Z","title":"A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s)…","vendor":"totolink","product":"Totolink","tier":"core","eol":null,"description":{"text":"A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","provenance":"source","from":"NVD"},"summary":{"text":"A path traversal flaw in the boa-based formUploadFile functionality of the Totolink X2000R router lets a crafted HTTP request write files to arbitrary locations, which can lead to code execution. An attacker needs network access to the device and must be authenticated to send the malicious request, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:58Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00633,"percentile":0.50293,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":6,"pulses":[{"name":"Known_Cve | Oct 29, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae20c23cd267c7cddd4e545","created":"2026-10-28"},{"name":"Known_Cve | Oct 28, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae0ba88997d8920e9952075","created":"2026-10-27"},{"name":"Known_Cve | Oct 27, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adf68beabc3bad24a2b7cc6","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6adb741adaae4be68dd04fea","created":"2026-10-23"},{"name":"Known_Cve | Oct 23, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ada237de8198eb6a6cbfac4","created":"2026-10-22"},{"name":"Known_Cve | Oct 22, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad8d34cb141a6cceeba88be","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2430","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-105333","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105333","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9827","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":18.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":10.06,"detail":"percentile 0.5029"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}