TOTOLINK X2000R: Stack-based buffer overflow in boa formMapDelDevice
Summary
The web administration interface (boa binary) of the TOTOLINK X2000R router contains a stack-based buffer overflow in the formMapDelDevice hostname handling. An attacker who holds valid admin credentials can send a specially crafted HTTP request that overflows the stack, which can lead to arbitrary code execution on the device. The CVSS score is 9.1 (Critical), but the attack requires authentication. Talos reports the flaw is patched in the firmware version available to them, but no fixed firmware is listed for the affected build.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only version listed)
Fixed in
Unknown. No vendor advisory or fixed firmware version found.
Workaround
- Disable remote (WAN) management and do not expose the admin web interface to the internet.
- Check port forwarding, UPnP and DMZ settings that could reach the admin interface.
- Restrict admin access to a trusted LAN segment or management VLAN.
- Change the admin password to a unique, strong one and remove default or shared credentials.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in CISA KEV.
- VulDB reports no public exploit available.
- EPSS below 1% (very low).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether the router's admin interface is reachable from the internet and disable remote management if it is.
- Restrict admin access to trusted internal systems and replace default or weak passwords.
- Check the TOTOLINK website and the device firmware page for a fixed build and apply it as soon as available.
- Review admin logs for unexpected logins or changed settings.
- If no fixed firmware appears, consider replacing the device.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos Vulnerability Report TALOS-2026-2389 talosintelligence.com
- OpenCVE CVE-2026-28763 app.opencve.io
- EUVD-2026-105350 vulners.com
- VulDB 423045 vuldb.com
- Talos Vulners mirror TALOS-2026-2389 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:02.
Original description (NVD)
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.