TOTOLINK X2000R: Stack-based buffer overflow in IPv6 static network setup
Summary
Totolink X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contain stack-based buffer overflows in the boa web server's formIpv6Setup static network configuration function. An attacker with valid administrator credentials can send a crafted HTTP request to overwrite the stack and execute arbitrary code on the device. The CVE record names the static_gw parameter, while related Talos reports from the same batch describe overflows in other static fields, so the exact parameter should be verified against the Talos report. Because authentication is required, the risk is lower for devices behind a managed firewall.
Affected
- TOTOLINK X2000R with firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
- Other firmware versions and models: Unknown.
Fixed in
Unknown. No vendor fix was found in the sources reviewed.
Workaround
- No vendor mitigation is known.
- Restrict access to the web management interface to a trusted LAN segment.
- Do not expose the management interface to the internet and disable remote management.
- Use strong, unique administrator passwords.
Exploitation
- No known exploitation in the wild.
- CISA SSVC lists exploitation as none and automatable as no.
- Not listed in CISA KEV.
- No public exploit found.
Our recommendation
- Check whether any X2000R is in use and whether its admin interface is reachable from the internet.
- Isolate or replace the device if TOTOLINK does not provide a firmware fix.
- Check TOTOLINK's support pages regularly for firmware updates.
- Monitor vendor advisories and updates to this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos TALOS-2026-2395 talosintelligence.com
- OpenCVE CVE-2026-42024 app.opencve.io
- Strix CVE-2026-42024 www.strix.ai
- THREATINT CVE-2026-42024 cve.threatint.com
- EUVD-2026-105343 vulners.com
- Cisco Talos TALOS-2026-2440 (product context) talosintelligence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:58.
Original description (NVD)
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.