TOTOLINK X2000R: Stack-based buffer overflow in boa formParentControl
Summary
The boa web server of the TOTOLINK X2000R router contains a stack-based buffer overflow in the formParentControl handler, triggered through the url parameters. An attacker with valid administrator credentials can send a specially crafted HTTP request to execute arbitrary code on the router. The CVSS score is 9.1 (Critical), but the attack requires high privileges and the vulnerability is only confirmed for one firmware build.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
- No other firmware versions are named in the sources.
Fixed in
Unknown. No fixed firmware or vendor advisory was found at the time of writing.
Workaround
- No vendor workaround documented.
- Restrict or disable the web administration interface on the WAN side and from untrusted networks.
- Disable remote management.
- Change default and weak administrator passwords.
Exploitation
- No public proof of concept known (VulDB).
- Not listed in CISA KEV; no evidence of exploitation in the wild.
- CISA SSVC: exploitation none, not automatable.
- EPSS below 1%.
Our recommendation
- Inventory all TOTOLINK X2000R devices and confirm the firmware build.
- Check whether the admin interface is reachable from the internet or untrusted networks and close that access.
- Change admin credentials and disable remote management.
- Monitor the TOTOLINK support site and the Talos report for a fixed firmware release, and apply it as soon as it is available.
- Re-check NVD once its analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos report TALOS-2026-2392 talosintelligence.com
- OpenCVE CVE-2026-41222 app.opencve.io
- VulDB 423050 vuldb.com
- CVE Threat Intelligence CVE-2026-41222 cve.threatint.com
- Strix CVE-2026-41222 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:04.
Original description (NVD)
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.