A stack-based buffer overflow exists in the batchupg feature of the Totolink X2000R. When an attacker crafts a specific HTTP request that the device accepts while the user is authenticated, the overflow allows arbitrary code to run on the device. The flaw is a classic CWE‑121 issue, giving an attacker full control over the affected system.

The vulnerability affects devices running the X2000R model, specifically firmware version TOTOLINK‑X2000R‑Gh‑V1.0.0‑B20250421.1327. No other models or firmware versions are currently identified as affected.

With a CVSS score of 9.1, the flaw is considered critical. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, but the attack vector requires authenticated access, which many administrators maintain. An attacker with such access can execute arbitrary code, compromise confidentiality, integrity, and availability of the device, and potentially pivot to other network assets.