An authenticated attacker can send a crafted HTTP request to the Totolink X2000R router's IPv6/PPPoE setup handler, overflow a stack buffer through the pppoe_dns1 parameter, and run arbitrary code.
What Is It
CVE-2026-42019 is a stack-based buffer overflow (CWE-121) in the formIpv6Setup PPPoE functionality of the boa web server on the Totolink X2000R. Cisco Talos reported it as one of several stack-based overflows in the same code path. This CVE covers the pppoe_dns1 parameter.
The NVD description says a crafted HTTP request can lead to arbitrary code execution. The attacker must be authenticated to send that request.
Why It Matters
Talos scored this flaw 9.1 (CRITICAL) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable: it can be exploited over the network.
- Easy to trigger: attack complexity is low and no user interaction is needed.
- High privileges required: the attacker needs authenticated, high-privilege access, which limits who can exploit it.
- Changed scope: a successful attack can affect resources beyond the vulnerable component.
- Full impact: confidentiality, integrity and availability impact are all high.
Arbitrary code execution on a router can give an attacker control of the device. CVE-2026-42019 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so active exploitation has not been confirmed. NVD lists the record's status as "Received," and it was published on 2026-10-20.
What's Vulnerable
The CNA (Talos) record lists one affected firmware build:
- Vendor: Totolink
- Product: X2000R
- Firmware:
TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
The record marks all other versions as unaffected by default. NVD lists no CPE entries yet.
Patch Status
The NVD record contains no fixed firmware version, vendor advisory or required action. Because the CVE is not listed in the CISA KEV catalog, no CISA remediation deadline applies.
If you run the affected build: - Check the Talos report and Totolink's support channels for updated firmware. - Restrict access to the router's web management interface. - Limit administrative credentials to trusted users.