CVE-2026-10131

{
  "etk_id": "ETK-2026-2224",
  "cve_id": "CVE-2026-10131",
  "display_id": "CVE-2026-10131",
  "ghsa_id": "GHSA-g7x5-7rwj-vqcc",
  "euvd_id": "EUVD-2026-105331",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OS command injection in X2000R password setup",
  "summary": "TOTOLINK X2000R devices running TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 are affected by an OS command injection flaw in the formPasswordSetup function. An authenticated attacker able to reach the HTTP management interface could execute arbitrary code on the device.",
  "mitigation": "Restrict the device's HTTP management interface to trusted administrators on a segregated management network and do not expose it to untrusted networks. Apply a vendor update when one is made available; no fixed version is recorded.",
  "vendor": "totolink",
  "product": "Totolink",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Totolink",
      "purl": null
    }
  ],
  "cwes": [
    78
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.64243085,
  "t0_at": "2026-10-20T20:25:20.907000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-20T20:25:20.907000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T20:25:20.907000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10131"
    }
  }
}