TOTOLINK X2000R: Stack-based buffer overflow in PPPoE IPv6 setup (pppoe_dns2)
Summary
The boa web administration interface of the TOTOLINK X2000R home router firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a stack-based buffer overflow in the formIpv6Setup PPPoE functionality, triggered via the pppoe_dns2 parameter. An attacker with an authenticated session can send a specially crafted HTTP request that leads to arbitrary code execution on the device. The CVSS vector requires high privileges (PR:H), so exposure depends on whether the web admin interface is reachable and how well the admin password is protected.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (the only version listed in the CNA record; other builds are not listed)
Fixed in
Unknown.
Workaround
- No vendor workaround is published.
- General hardening, not vendor guidance: disable web admin access from the WAN, restrict it to trusted LAN hosts, change the admin password and remove unused admin accounts.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public exploit or active exploitation is known.
Our recommendation
- Confirm the firmware build on each X2000R device.
- Disable WAN access to the web admin interface and restrict LAN access to trusted hosts.
- Change the admin password and remove unused accounts.
- Check TOTOLINK support for a fixed firmware and apply it as soon as it is available.
- If the device is internet-facing with an exposed admin page, consider replacing it or placing it behind a restricted management VPN until a fix is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos TALOS-2026-2394 vulnerability report talosintelligence.com
- OpenCVE: CVE-2026-42020 app.opencve.io
- ThreatINT: CVE-2026-42020 cve.threatint.com
- Vulners: TALOS-2026-2394 vulners.com
- VulDB entry 424068 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:56.
Original description (NVD)
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns2 parameter.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.