A stack‑based buffer overflow exists in the Boa formIpv6Setup PPPoE functionality of the Totolink X2000R router. A specially crafted HTTP request that includes a malicious value for the pppoe_dns1 parameter can overflow a buffer on the stack and allow an attacker to execute arbitrary code on the device. The description indicates that the exploit requires an authenticated HTTP request, implying that the attacker must have valid user credentials or otherwise compromise the authentication mechanism before sending the malicious packet.

Totolink X2000R router, firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, produced by Totolink.

The CVSS score for this vulnerability is 9.1, which places it in the high‑severity range. The EPSS score is currently not available, and it is not listed in the CISA KEV catalog. The attack vector is authenticated over HTTP, meaning that the attacker must first gain valid credentials or bypass the authentication. Because the flaw is a buffer overflow that can lead to arbitrary code execution, the overall risk is high for any system running the affected firmware.