This vulnerability is a stack-based buffer overflow (CWE‑121) located in the Boa formIpv6Setup PPPoE functionality of the Totolink X2000R model. A specially crafted HTTP request that contains an exploitable pp­poe_dns2 parameter can overflow a buffer on the device’s stack, enabling arbitrary code execution. The vulnerability is classified as a critical flaw with a CVSS score of 9.1, meaning that an attacker who can trigger it can run malicious code with the privileges of the vulnerable process.

Having been identified in firmware version TOTOLINK‑X2000R‑Gh‑V1.0.0‑B20250421.1327 of the Totolink X2000R router, the flaw is specific to this version and affects all instances running that build. The vendor listed in the CNA is Totolink, and the product is the X2000R router. No broader products or earlier versions were mentioned, so the scope is limited to devices with the reported firmware release.

The CVSS score signals high severity, and the absence of an EPSS rating indicates that the exploit probability data is not available, although the flaw remains potentially exploitable. Because the attack requires an authenticated HTTP request, an attacker needs valid credentials or must first compromise the device’s administration interface. Once the buffer overflow is triggered, the attacker can execute arbitrary code, likely allowing full control over the device. The vulnerability is not listed in the CISA KEV catalog as of the latest data, but its critical nature warrants prompt action from all affected owners.