TOTOLINK X2000R: Stack-based buffer overflow in boa formIpQos mac handler
Summary
The boa web administration component of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) contains a stack-based buffer overflow in the formIpQos function, triggered by the mac parameter. An attacker who has a valid logged-in session can send a specially crafted HTTP request and execute arbitrary code on the device. The CVSS base score is 9.1 (critical), and the attack requires high privileges and a network-reachable admin interface.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only version listed by the CNA)
- Builds older than this are not confirmed as affected or unaffected.
Fixed in
Unknown. No vendor fix or patched firmware was confirmed at the time of research.
Workaround
- No vendor-confirmed workaround is known.
- Do not expose the web administration interface to the internet or the WAN side.
- Restrict admin access to a management network or trusted IP addresses.
- Change default and weak administrator passwords.
Exploitation
- No evidence of exploitation in the wild was found.
- CISA SSVC in the CNA record: Exploitation none, Automatable no, Technical Impact total.
- VulDB reports that technical details are known, but its exploitability assessment conflicts with the SSVC value.
- EPSS is 0.00946 at the time of the snapshot, which is low.
Our recommendation
- Check whether any TOTOLINK X2000R is in use.
- Confirm that the web administration interface is not reachable from the internet.
- Set a strong, unique administrator password.
- Check the TOTOLINK support site and the Talos advisory regularly for a firmware fix.
- If no fix is published, plan the replacement of the device.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos advisory TALOS-2026-2433 talosintelligence.com
- VulDB entry 423038 vuldb.com
- OpenCVE CVE-2026-10132 app.opencve.io
- CVE mirror CVE-2026-10132 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:12.
Original description (NVD)
A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.