Description
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.
Published: 2026-10-20
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Multiple stack‑based buffer overflow vulnerabilities have been identified in the boa formIpv6Setup static network configuration function of Totolink X2000R routers. A specially crafted HTTP request containing an abused static_dns2 parameter can trigger these overflows, allowing an authenticated attacker to execute arbitrary code on the device.

Affected Systems

The affected product is the Totolink X2000R router, firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, sold under the Totolink brand.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.1, indicating critical severity. EPSS is not available, and the flaw is not listed in CISA's KEV catalog. Attackers must first authenticate to the HTTP management interface to send the malicious request, but once authenticated, the exploitation can lead to complete compromise of the device.

Generated by OpenCVE AI on October 20, 2026 at 22:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the router to the latest firmware release that addresses the static_dns2 buffer overflow issue.
  • If a firmware update is not immediately possible, restrict HTTP management access to trusted internal networks or block the interface from external exposure.
  • Deploy network monitoring or intrusion detection systems to detect repeated attempts to abuse the static_dns2 parameter and terminate sessions that exhibit suspicious activity.

Generated by OpenCVE AI on October 20, 2026 at 22:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink x2000r
Vendors & Products Totolink
Totolink x2000r

Tue, 20 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Stack‑Based Buffer Overflow in Totolink X2000R Static IPv6 Configuration

Tue, 20 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Totolink X2000r
cve-icon MITRE

Status: PUBLISHED

Assigner: talos

Published:

Updated: 2026-10-23T22:08:24.455Z

Reserved: 2026-04-23T14:17:27.876Z

Link: CVE-2026-42022

cve-icon Vulnrichment

Updated: 2026-10-23T20:45:25.977Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T21:17:19.257

Modified: 2026-10-23T23:17:43.730

Link: CVE-2026-42022

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T16:43:52Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow