TOTOLINK X2000R: Stack-based buffer overflow in boa formMapDelDevice
Summary
A stack-based buffer overflow in the boa web server handler formMapDelDevice of the TOTOLINK X2000R router allows arbitrary code execution. The macstr parameter is copied unchecked into a stack buffer in the /bin/map_del_device helper. Exploitation requires an authenticated HTTP request, so valid credentials are needed to reach the vulnerable code.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (the only version listed in the CVE record)
Fixed in
Unknown. No fixed firmware version or vendor advisory was found.
Workaround
Unknown. No vendor workaround was found. Restrict access to the web administration interface and use strong, unique passwords.
Exploitation
- No public exploit known at the time of research.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- Not listed in the CISA KEV catalog, no reports of in-the-wild exploitation found.
Our recommendation
- Do not expose the web administration interface of the X2000R to the internet; disable WAN-side management.
- Restrict admin access to trusted internal hosts or a management VLAN.
- Change default and weak administrator passwords.
- Check the TOTOLINK support pages regularly for a fixed firmware and apply it as soon as available.
- If no fix becomes available, plan to replace the device.
- Monitor the device for unexpected configuration or firmware changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Talos Vulnerability Report TALOS-2026-2390 talosintelligence.com
- VulDB 423051 vuldb.com
- OpenCVE CVE-2026-41223 app.opencve.io
- Threatint CVE-2026-41223 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:05.
Original description (NVD)
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.