A stack-based buffer overflow exists in the boa formMapDelDevice hostname function of a TOTOLINK X2000R router. The overflow allows an attacker to supply a specially crafted HTTP payload that corrupts the stack, ultimately enabling arbitrary code execution on the device. The weakness is identified as CWE‑121 and operates when a user is authenticated, meaning the attacker must first gain valid credentials or otherwise authenticate to the device before triggering the vulnerability.

The vulnerability affects TOTOLINK X2000R routers running firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Only the specified build appears to be impacted; newer or different firmware releases may not contain the flaw.

The CVSS score of 9.1 reflects the high severity of this flaw. EPSS data is not available and the issue is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. However, because the exploit requires only a crafted authenticated HTTP request, an attacker who obtains valid credentials—or brute‑forces the login—could easily trigger the buffer overflow. The lack of a public exploit does not reduce the risk, as the path to execution is straightforward and no mitigations are referenced in the advisory.