CVE-2026-35499: Totolink X2000R Router CVSS 9.1 Flaw Allows Remote Code Execution

The National Vulnerability Database has recorded a critical command injection flaw in the Totolink X2000R router. This issue allows attackers to run arbitrary code on the device through a specially crafted HTTP request.

What happened

The vulnerability, identified as CVE-2026-35499, carries a CVSS base score of 9.1, which the NVD classifies as critical. The flaw resides within the boa formWsc peerRptPin functionality of the router’s web interface. It is classified under CWE-78, indicating improper neutralization of special elements used in an OS command.

According to the NVD record, the specific firmware version affected is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. The description notes that an attacker must make an authenticated HTTP request to trigger the vulnerability. This means the threat actor must first obtain valid login credentials for the router’s administration panel. Once authenticated, they can send a crafted request that leads to arbitrary code execution on the device.

Why it matters

Command injection vulnerabilities are particularly dangerous because they allow attackers to bypass application logic entirely. With the ability to execute arbitrary code, an attacker can potentially take full control of the router. This could enable them to redirect network traffic, install malware, or use the device as a pivot point for further attacks on the internal network.

The requirement for authentication reduces the immediate risk to unauthenticated internet scanners. However, router admin credentials are often weak or reused, making them a common target for brute-force attacks. If an attacker gains initial access, this vulnerability provides a reliable path to full system compromise.

What to watch

• Monitor the Totolink support site for any firmware announcements regarding CVE-2026-35499.
• Watch for security advisories from upstream vendors like Boa or other components used in the firmware.
• Observe threat intelligence feeds for any reports of exploitation in the wild.
• Check network logs for unusual authenticated requests to the router's web interface.

Who needs to act first

IT managers should prioritize reviewing devices running the specific affected firmware version. Teams usually start by identifying all instances of this hardware in their environment. Check whether these routers are exposed to untrusted networks or remote management interfaces. Reduce exposure by ensuring strong, unique passwords are set for all admin accounts. Consider isolating affected devices on separate VLANs until further guidance is available. Back up current configurations to ensure recovery options exist if changes are needed later.

What to do and how to stay safe: Totolink

• Verify if any managed networks are using the specific Totolink X2000R firmware version mentioned in the advisory.
• Ensure that all router administrative interfaces are protected with strong, complex credentials to mitigate the authentication requirement.
• Restrict access to the router's web management interface so that it is not reachable from untrusted networks.
• Review firewall rules to limit incoming traffic to only necessary ports and services for the router.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for this vulnerability?

The CVSS score for CVE-2026-35499 is 9.1, which is rated as critical.

Is there a fix available for this issue?

The source material does not state whether a fix or update is available.

Which firmware version is affected?

The affected version is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.