An authenticated attacker can send a crafted HTTP request to the boa web server on a TOTOLINK X2000R router, overflow a stack buffer in the parental control deviceName handler and execute arbitrary code.
What Is It
CVE-2026-40615 is a stack-based buffer overflow (CWE-121) in the formParentControl handler of the boa web server on the TOTOLINK X2000R router. The flaw is in how the handler processes the deviceName parameter. According to the NVD record, a specially crafted HTTP request can lead to arbitrary code execution. Cisco Talos reported the vulnerability (TALOS-2026-2393). NVD published it on 2026-10-20 and currently lists it as "Received."
Why It Matters
The CVSS v3.1 base score is 9.1 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network attack vector, low complexity: the attack works over the network and needs no special conditions.
- High privileges required: the attacker must send an authenticated HTTP request, so they need valid credentials for the device.
- No user interaction: no other user has to do anything for the attack to work.
- Scope changed: a successful attack can affect resources beyond the vulnerable component.
- High impact: confidentiality, integrity and availability are all rated high.
Code execution on an edge router gives an attacker a strong foothold on the network it serves. The authentication requirement reduces exposure, but default, weak or reused admin credentials would make this flaw much easier to exploit.
Exploitation status: This CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. CISA has not listed it as known to be exploited, and the sources cited here show no evidence of exploitation in the wild.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The CNA record marks all other versions "unaffected" by default and lists only the firmware build above as affected. NVD lists no CPE entries yet.
Patch Status
The cited sources do not mention a vendor patch or a fixed firmware version. The CVE is not in the CISA KEV catalog, so CISA has not set a required action or remediation deadline. Until TOTOLINK confirms a fix, administrators running the affected build should:
- Restrict access to the router's web management interface.
- Make sure administrative credentials are strong and unique.
- Watch TOTOLINK and the Talos advisory for firmware updates.