A stack‑based buffer overflow in the boa formParentControl deviceName functionality of the Totolink X2000R allows an attacker to craft a malicious HTTP request that, when sent with valid credentials, can overwrite return addresses on the stack and execute arbitrary code. The vulnerability directly compromises the confidentiality, integrity, and availability of the affected device. It requires authenticated access, meaning that an attacker must first obtain valid credentials or use a compromised account to trigger the flaw.

The flaw is present in the X2000R model running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. No other affected versions are listed in the data, but any devices using this firmware revision are impacted.

The CVSS score of 9.1 indicates a very high severity. The EPSS score is not available, but the vulnerability remains exploitable through an authenticated HTTP request, suggesting that attackers with access to the device’s management interface can achieve full control. The issue is not flagged in the CISA KEV catalog, yet the potential impact of arbitrary code execution warrants vigilant response.