The vulnerability is a stack-based buffer overflow in the Mcli functionality of the Totolink X2000R router. A specially crafted HTTP request that targets this function can overwrite the stack and allow the attacker to execute arbitrary code on the device. The exploit requires that the attacker be authenticated to the device’s management interface, indicating that privileged access or credentials are needed for successful exploitation.

The affected product is the Totolink X2000R router running firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Firmware builds prior to this release may also be impacted, but the specific evidentiary version is identified above.

The CVSS score of 9.1 marks this flaw as critical, and while no EPSS data is available, the absence of a KEV listing does not diminish the potential impact. An authenticated attacker can reach the vulnerable endpoint remotely, suggesting a likely attack path from a compromised internal network or a user who has gained credentials. The lack of public exploitation data implies that, so far, the vulnerability has not been actively exploited in the wild, but given its high severity, immediate defensive measures are warranted.