A stack-based buffer overflow exists in the boa formIpQos mac functionality of the Totolink X2000R router. A specially crafted HTTP request, sent by an authenticated user, can overwrite stack memory and cause arbitrary code execution. The vulnerability allows an attacker who has gained authentication to the device to run malicious code with the privileges of the router, potentially compromising network traffic, captive portals, or other connected devices. The impact is a full compromise of the affected system, including confidentiality, integrity, and availability of the network. The description states the overflow requires authentication, so privilege escalation is needed, but once achieved the attacker can control the device. The vulnerability is identified as CWE-121, a classic stack-based buffer overflow flaw that originates from insufficient bounds checking on input data. Because the flaw is in a key HTTP-based management interface, the likelihood of exploitation on an exposed device is high if credentials are known or discoverable. The CVSS score of 9.1 classifies the vulnerability as critical. No EPSS score is available, but the lack of public exploitation data does not reduce the risk, as attackers can easily craft the malicious request. The vulnerability is not listed in the CISA KEV catalog, yet the high CVSS and the requirement for authentication mean that an internal or compromised attacker could leverage this flaw to gain full control over the router.

The vulnerability affects Totolink X2000R routers running firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or earlier. The flaw is located in the boa formIpQos mac functionality accessible via the device’s web management interface.

The CVSS score of 9.1 classifies this flaw as critical. The flaw requires an authenticated HTTP request, so an attacker must obtain valid login credentials or compromise an account with sufficient privileges. Once the HTTP request is crafted and sent, the stack overflow can execute arbitrary code with the privileges of the router, effectively allowing full system takeover. The EPSS score is currently unavailable; however, the absence of public exploitation does not reduce the risk, as the technical barrier is low. This vulnerability is not listed in the CISA KEV catalog. Attackers who have access to the local network or exploit exposed management interfaces could exploit this flaw if authentication mechanisms are weak or credentials are compromised.