CVE-2026-10136

CriticalCVSS 9.1/10Last modified Oct 23, 2026

Description

A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1013605.4Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vuCVE-2026-1013614.2Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit CVE-2026-1013626.9Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit CVE-2026-1013635.3Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitablCVE-2026-1013645.4Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exCVE-2026-1013654.7Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exCVE-2026-1013664.3Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulCVE-2026-1013675.4Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulCVE-2026-1013685.4Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. EasilCVE-2026-1013696.1Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. EasilCVE-2026-101379.1A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B2CVE-2026-1013703.1Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit