TOTOLINK X2000R: Stack-based buffer overflow in web management
Summary
Stack-based buffer overflows exist in the boa web server of the TOTOLINK X2000R router, in the IPv6 static network configuration (formIpv6Setup), triggered through the static_dns1 parameter. An attacker who sends a specially crafted HTTP request can execute arbitrary code on the router. The attacker must be authenticated, which requires valid high-privilege credentials. The CVE record rates the issue CRITICAL (CVSS 9.1).
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
- Scope to verify: the sibling CVE-2026-42022 names the static_dns2 parameter, and one Talos summary names the function formWsc peerRptPin instead of formIpv6Setup
Fixed in
Unknown. No fixed firmware version has been published at the time of writing.
Workaround
No vendor workaround is documented for this CVE.
Exploitation
- CISA SSVC: exploitation none, not automatable
- Not listed in the CISA KEV catalogue
- No public proof of concept or in-the-wild exploitation known as of publication on 20 October 2026
Our recommendation
- Check whether the router's admin interface is reachable from the internet and disable remote management
- Restrict admin access to trusted LAN devices and change default credentials
- Monitor TOTOLINK for firmware updates and install them as soon as they are available
- If no fix is published, consider replacing the device or isolating it from sensitive networks
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos advisory TALOS-2026-2395 talosintelligence.com
- OpenCVE record CVE-2026-42021 app.opencve.io
- ThreatInt CVE record CVE-2026-42021 cve.threatint.com
- VulDB entry 424070 vuldb.com
- Vulners Talos entry TALOS-2026-2395 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:56.
Original description (NVD)
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.