CVE-2026-40615

CriticalCVSS 9.1/10Last modified Oct 22, 2026

Description

A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-406187.5When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP CVE-2026-406197.8A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local CVE-2026-40627.5The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in al CVE-2026-406209.8A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of au CVE-2026-406219.3ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated wi CVE-2026-406227.5NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could ex CVE-2026-406238.1A vulnerability in SenseLive X3050's web management interface allows critical system and network configuration parameters to be modified wit CVE-2026-406249.8Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras may allow a remote, unauthenticated attacker to achieve ar CVE-2026-406279.1An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B202 CVE-2026-406297.5When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connect CVE-2026-40634.3The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability c CVE-2026-406309.8A vulnerability in SenseLive X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improp