TOTOLINK X2000R: Stack-based buffer overflow in boa formIpv6Setup (pppoe_dns1)
Summary
A stack-based buffer overflow in the PPPoE DNS handling (parameter pppoe_dns1) of the boa web server on the TOTOLINK X2000R router allows an attacker to execute arbitrary code. The attacker must first log in to the router's web interface with valid credentials (high privileges). The CVSS score is 9.1 (Critical), but the score comes from the Talos CNA because NVD analysis is deferred.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only version listed as affected)
Fixed in
Unknown. No vendor fix or patched firmware has been confirmed.
Workaround
- If PPPoE is not required by the internet connection, disable it (check with the ISP first, as some lines depend on PPPoE).
- Block or restrict access to the router's web management interface; do not expose it to the internet.
- Restrict management access to the LAN or a dedicated management VLAN and use strong, unique admin credentials.
These measures are not vendor-confirmed.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in CISA KEV.
- No public proof-of-concept exploit found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether any TOTOLINK X2000R devices are in use and whether their web management is reachable from the internet (WAN-side management, port forwards to ports 80 or 443, default credentials).
- Remove internet exposure of the admin interface and restrict management to trusted internal hosts.
- Change default admin passwords and limit the number of admin accounts.
- Ask TOTOLINK support for a fix timeline and check their firmware download pages regularly.
- If no patch is released, plan to replace the device or isolate it from sensitive network segments.
- Monitor the router for unexpected configuration changes or outbound connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos TALOS-2026-2394 talosintelligence.com
- OpenCVE CVE-2026-42019 app.opencve.io
- Strix CVE-2026-42019 www.strix.ai
- ThreatInt CVE-2026-42019 cve.threatint.com
- Vulners TALOS-2026-2394 vulners.com
- OpenCVE CVE-2026-42020 (related pppoe_dns2 issue) app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:05.
Original description (NVD)
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns1 parameter.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.