CVE-2026-41223 is a critical (CVSS 9.1) stack-based buffer overflow in the TOTOLINK X2000R's boa web server, and an authenticated attacker can use it to execute arbitrary code with a crafted HTTP request.
What Is It
The flaw is a stack-based buffer overflow (CWE-121) in the formMapDelDevice handler of the X2000R's boa web server. The bug sits in how the handler processes the macstr parameter. Cisco Talos reported it as the CVE Numbering Authority. According to the NVD record, a specially crafted HTTP request to this function can lead to arbitrary code execution. Triggering the bug requires an authenticated HTTP request.
NVD published the record on 2026-10-20. It is still in "Received" status, which means NVD has not yet run its own analysis.
Why It Matters
Talos scores the issue 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable, low complexity: the attacker sends a single crafted HTTP request and needs no user interaction.
- High privileges required: the attacker must already be authenticated with high privileges. This is the main limiting factor and is reflected in the exploitability subscore of 2.3.
- Scope changed: a successful exploit can affect resources beyond the vulnerable component.
- Full impact: confidentiality, integrity and availability are all rated High, with an impact subscore of 6.0.
Arbitrary code execution on an edge router gives an attacker a strong foothold on the network behind it.
Exploitation status: CVE-2026-41223 is not currently listed in the CISA Known Exploited Vulnerabilities catalog. No active exploitation has been confirmed in the supplied data.
What's Vulnerable
- Vendor: TOTOLINK
- Product: X2000R
- Affected firmware:
TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 - Component: boa web server,
formMapDelDevice(macstrparameter)
The CNA record lists the default status for other versions as "unaffected." NVD has not yet published CPE data for this CVE.
Patch Status
The supplied NVD and KEV data does not mention a fixed firmware release or vendor remediation guidance. Because the CVE is not in KEV, there is no CISA-mandated required action or due date. Owners of X2000R devices on the affected build should check the Talos advisory and TOTOLINK's support channels for updated firmware.