SecBoard
Zurück zur CVE-Übersicht

CVE-2026-10139

CRITICAL(9.1)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score28/100 — MITTEL
  • CVSS 9.1 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.9%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.1

Technische Schwere

Beschreibung

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection for authenticated HTTP requests targeting the Mcli functionality, potentially leading to arbitrary code execution due to a stack-based buffer overflow. Focus on unusual HTTP request patterns to /boafrm/form* pages after successful authentication.

Sentinel/Defender KQL

DeviceNetworkEvents
| where ActionType == "HttpRequest" and RemoteUrl contains "/boafrm/form" and InitiatingProcessCommandLine contains "boa"
| join kind=inner (DeviceLogonEvents | where ActionType == "SuccessfulInteractiveLogon") on DeviceId
| extend RequestTime = Timestamp
| where RequestTime > LogonTime and RequestTime < (LogonTime + 1h) // Adjust time window as needed
| project DeviceName, RemoteUrl, InitiatingProcessCommandLine, RequestTime, LogonTime, AccountName
| summarize count() by DeviceName, RemoteUrl, AccountName
| where count_ > 5 // Threshold for unusual activity, adjust as needed

Splunk SPL

sourcetype=web_access_logs "/boafrm/form*" | stats count by clientip, uri_path | where count > 5

Sigma

title: Totolink X2000R Mcli Buffer Overflow Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation attempts against Totolink X2000R Mcli functionality via authenticated HTTP requests.
references:
    - https://talosintelligence.com/vulnerability_reports/TALOS-2026-2439
author: SecBoard
date: 2026/10/20
logsource:
    category: webserver
    product: generic
detection:
    selection:
        c-uri|contains: '/boafrm/form'
        sc-status: 200 # Assuming successful authenticated request
    condition: selection
fields:
    - c-ip
    - c-uri
    - cs-username
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.10139
level: high

Elastic ES|QL

FROM logs-webserver-access-*
| WHERE url.path LIKE '/boafrm/form%'
| WHERE http.response.status_code == 200
| GROUP BY source.ip, url.path
| AGGREGATE request_count = COUNT()
| WHERE request_count > 5

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (2)

  • www.totolink.net
  • talosintelligence.com

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen