The CVE details multiple stack‑based buffer overflow vulnerabilities in the Boa formIpv6Setup static network configuration function of the Totolink X2000R router, specifically affecting firmware build TOTOLINK‑X2000R‑Gh‑V1.0.0‑B20250421. A specially crafted HTTP request can exploit the static_ipv6 parameter handling, enabling an attacker who is authenticated to the router's configuration interface to execute arbitrary code. This classic stack overflow maps to CWE‑121.

The vulnerability affects the Totolink X2000R model running firmware version TOTOLINK‑X2000R‑Gh‑V1.0.0‑B20250421. Only this specific firmware build is known to contain the flawed static IPv6 configuration handler.

With a CVSS score of 9.1 the issue is considered Critical, and the EPSS score is unavailable, making it unclear how often it has been exploited in the wild. CISA does not list it in its KEV catalog, suggesting no known widespread exploitation yet. The attack requires an authenticated HTTP session against the device’s configuration API; once the malicious request is processed, an attacker can execute arbitrary code on the router’s operating system. Because the vector is network‑based and authenticated, compromised credentials or default accounts significantly shorten the window for exploitation.