The flaw is a stack-based buffer overflow located in the boa formFilter component of the Totolink X2000R router. A malicious, specially crafted HTTP request that includes an authenticated vpnPassword parameter can trigger the overflow, allowing the attacker to execute arbitrary code on the device. Because the overflow is only triggered when an authenticated HTTP request is processed, the vulnerability does not permit unauthenticated attackers to exploit it directly; however, once credentials are obtained, the attacker gains complete control of the device.

The affected product is the Totolink X2000R router running firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. No other firmware versions are listed as vulnerable in the CNA data.

With a CVSS score of 9.1, the vulnerability is classified as critical, indicating potential for full system compromise. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The absence of a KEV listing does not reduce the intrinsic risk. Because the attack requires valid authentication to trigger the overflow, the likelihood of widespread exploitation may be lower than a purely unauthenticated flaw, yet the impact once authenticated is severe, providing an attacker with complete device control.