An authenticated attacker can send a crafted HTTP request to the boa web server on the TOTOLINK X2000R router, overflow the stack in its parental control URL handler, and run arbitrary code on the device.
What Is It
CVE-2026-41222 is a stack-based buffer overflow (CWE-121) in the formParentControl URL handler of the boa web server on the TOTOLINK X2000R. A specially crafted HTTP request can lead to arbitrary code execution. The attacker must already be authenticated to send it.
Cisco Talos ([email protected]) assigned the CVE. NVD published it on October 20, 2026, and its status is currently "Received", which means NVD has not yet analyzed it.
Why It Matters
Talos scores the flaw CVSS 3.1 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. That breaks down as:
- Network-exploitable with low attack complexity
- No user interaction required
- High privileges required, so the attacker needs valid credentials at a high privilege level
- Scope changed, so a successful exploit can affect resources beyond the vulnerable component
- High impact to confidentiality, integrity and availability
The high-privilege requirement keeps the exploitability subscore at 2.3. Even so, code execution on a router means an attacker could take over the device and see the traffic passing through it.
Exploitation status: The supplied CISA KEV data contains no entry for this CVE. The source material does not confirm active exploitation.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The CNA record sets the default status to "unaffected" and lists only the firmware build above as affected. NVD has not published any CPE matches yet.
Patch Status
The supplied NVD record does not list a fixed firmware version, a vendor advisory or a patch. CISA has not set a required action or due date, because the CVE is not in KEV.
Until TOTOLINK publishes fixed firmware, owners of affected X2000R devices should:
- Check the Talos report for vendor coordination details and any fix guidance.
- Limit who can reach the router's web management interface.
- Use strong, unique administrative credentials, since the attacker must be authenticated to exploit this.
Sources
- NVD, CVE-2026-41222
- Cisco Talos; TALOS-2026-2392
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in the supplied data)