TOTOLINK X2000R: Stack-based buffer overflow in dhcp_dns1 parameter
Summary
The TOTOLINK X2000R home router is affected by a stack-based buffer overflow in its web administration interface (boa formIpv6Setup, dhcp_dns functionality). An authenticated attacker can send a crafted HTTP request with an overlong dhcp_dns1 value and execute arbitrary code on the device. Because the scope is changed (S:C) and the impact is high, a compromised router can affect the whole network segment.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only documented affected build)
Fixed in
Unknown. No fixed firmware version is published in the sources reviewed.
Workaround
- Keep the web administration interface reachable only from the LAN; disable WAN-side and remote management unless strictly required.
- Change default admin credentials and limit the number of accounts with admin rights, since exploitation requires authentication.
- Do not expose the router web interface to the internet.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found in the sources reviewed; this is not proof of absence.
- No reports of exploitation in the wild found.
Our recommendation
- Inventory all TOTOLINK X2000R devices and verify the exact firmware build.
- Restrict admin access to the LAN and enforce strong, unique admin passwords now.
- Check TOTOLINK's download pages and the Talos advisory regularly for a fixed firmware; if none is released, plan replacement of the device.
- Monitor the router's web interface logs for unusual login activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos TALOS-2026-2396 talosintelligence.com
- OpenCVE CVE-2026-42025 app.opencve.io
- Strix CVE-2026-42025 www.strix.ai
- ThreatInt CVE-2026-42025 cve.threatint.com
- Vulners Positive Technologies PT-2026-118664 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:00.
Original description (NVD)
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.