TOTOLINK X2000R: Stack-based buffer overflow in boa formIpv6Setup
Summary
The TOTOLINK X2000R home router is affected by a stack-based buffer overflow in the boa web administration function formIpv6Setup, triggered via the dhcp_dns2 parameter. An attacker who is logged in to the web interface can send a specially crafted HTTP request and execute arbitrary code on the device. Exploitation requires authentication, so the risk is highest if the web administration is reachable from the internet or still uses default credentials.
Affected
- TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
- Other firmware builds are not listed in the CNA record; their status is unknown.
Fixed in
Unknown. No fixed firmware version has been published in the sources reviewed.
Workaround
No vendor workaround documented.
- Do not expose the web administration interface to the internet; disable WAN management.
- Restrict admin access to a trusted LAN segment or management VLAN.
- Change default or weak admin passwords and review admin accounts.
Exploitation
- No known exploitation in the wild.
- Not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept known.
Our recommendation
- Inventory all TOTOLINK X2000R devices and their firmware build.
- Check whether the web administration is reachable from the internet and close that exposure.
- Change admin passwords and limit admin access to trusted devices.
- Check the TOTOLINK support site regularly for a fixed firmware; plan replacement if no fix is released.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos Vulnerability Report TALOS-2026-2396 talosintelligence.com
- OpenCVE: CVE-2026-42026 app.opencve.io
- Strix: CVE-2026-42026 www.strix.ai
- Threat Intelligence: CVE-2026-42026 cve.threatint.com
- Talos report TALOS-2026-2440 (related) talosintelligence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:01.
Original description (NVD)
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.