A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration of Totolink X2000R devices. A specially crafted authenticated HTTP request targeting the static_dns1 parameter can overwrite memory and execute arbitrary code. The vulnerability is a classic CWE‑121 buffer overflow that can allow an attacker with valid HTTP credentials to achieve full code execution on the device.

The affected product is the Totolink X2000R model, specifically firmware version TOTOLINK‑X2000R‑Gh‑V1.0.0‑B20250421.1327. Users of this router, or any other device from the Totolink X2000R family, may be impacted if running this version or earlier. No other vendors or products were listed as affected.

The CVSS score of 9.1 classifies the issue as critical, indicating substantial confidentiality, integrity, and availability impact. EPSS data is not available, but the vulnerability requires authentication and modifies a router configuration parameter, implying that an attacker must first compromise credentials or exploit a compromised management session. The vulnerability is not listed in CISA KEV, suggesting that it has not yet been widely exploited in the wild, yet the high severity and ability to execute arbitrary code make it a high priority for swift action.