A stack-based buffer overflow exists in the boa formParentControl URL functionality of the Totolink X2000R, allowing an attacker to send a specially crafted HTTP request that can be exploited only after authentication to trigger arbitrary code execution. The vulnerability is a classic buffer overflow under CWE-121, meaning the attack can overwrite the return address and take control of the program flow.

The affected product is the Totolink X2000R router, specifically the firmware revision TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Only this version contains the vulnerability as identified by the vendor.

The CVSS base score of 9.1 indicates a critical risk. EPSS is not available, but the lack of a KEV listing does not lower the danger; it remains a high‑severity flaw. The attack is likely network‑based, requiring an authenticated HTTP request to the router’s management interface. Given the stack overflow nature, successful exploitation would permit remote code execution with the privileges of the router’s operating system.