TOTOLINK X2000R: Stack-based buffer overflow in IPv6 static configuration
Summary
The web administration of the TOTOLINK X2000R router, handled by the boa formIpv6Setup function, contains a stack-based buffer overflow in the static_ipv6 parameter. An authenticated attacker can send a specially crafted HTTP request to overwrite memory and execute arbitrary code on the device, which Talos rates as CVSS 9.1 (Critical). Exploitation requires valid administrator credentials, and the sources report the affected firmware as TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
- Component: boa web server, formIpv6Setup (static IPv6 configuration), parameter static_ipv6
- Note: the Talos mirror summary refers to another function (formWsc peerRptPin), so the affected handler should be confirmed with Talos.
Fixed in
Unknown. No vendor advisory or firmware fix was found at the time of research.
Workaround
- No vendor mitigation has been published for this CVE.
- Block management access from the WAN and remove port forwards to the web interface.
- Restrict admin access to a management VLAN or specific IP addresses.
- Disable remote administration and unused IPv6 static configuration.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV.
- No public proof of concept or exploitation in the wild was found in the sources reviewed.
Our recommendation
- Inventory all TOTOLINK X2000R devices and record their firmware version.
- Remove any internet exposure of the web administration interface and check for port forwards.
- Change default and weak administrator passwords.
- Check the vendor for a newer firmware; if none is available, plan replacement of the device.
- Monitor the Talos advisory, NVD and CISA KEV for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos TALOS-2026-2395 talosintelligence.com
- OpenCVE CVE-2026-42023 app.opencve.io
- Vulners Talos TALOS-2026-2395 vulners.com
- Strix CVE-2026-42023 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:58.
Original description (NVD)
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.