A stack-based buffer overflow exists in the boa formUpload() function of the X2000R model. A crafted HTTP request can overflow the stack and allow an attacker to execute arbitrary code. Because the request must be authenticated, the vulnerability requires valid user credentials, limiting impact to users who can log in. Successful exploitation results in complete compromise of the device, giving the attacker full control over the system’s data and functionality.

The vulnerability affects Totolink X2000R devices running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. No other products or versions are listed as affected.

The CVSS score is 9.1, indicating high severity. EPSS data is not available, and the issue is not in the CISA KEV catalog. The attack vector is remote via authenticated HTTP; an attacker must first authenticate to the device in order to deliver the crafted request. If credentials are compromised or default credentials are used, the likelihood of exploitation is significant. The absence of publicly listed zero‑day exploits suggests that active exploitation may be limited, but the high severity warrants rapid mitigation.