CVE-2026-42020 is a critical (CVSS 9.1) stack-based buffer overflow in the Totolink X2000R router's web server: a crafted, authenticated HTTP request that abuses the pppoe_dns2 parameter can lead to arbitrary code execution.
What Is It
CVE-2026-42020 is a stack-based buffer overflow (CWE-121) in the formIpv6Setup PPPoE functionality of the boa web server on the Totolink X2000R. It is one of several stack-based overflows in the same feature. This entry covers the pppoe_dns2 parameter.
An attacker who can send an authenticated HTTP request with a specially crafted pppoe_dns2 value can trigger the overflow. According to the CVE description, that can lead to arbitrary code execution. Cisco Talos assigned the CVE and reported the issue as TALOS-2026-2394.
Why It Matters
Talos rates the flaw 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Here is what the vector means:
- Network-reachable with low attack complexity
- High privileges required, meaning the attacker must be authenticated
- No user interaction needed
- Changed scope, so the impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity and availability
The high-privilege requirement narrows who can exploit it. Even so, code execution on an edge router with changed scope is serious. Because exploitation requires an authenticated session, the main risk comes from attackers who already hold valid admin credentials, for example credentials that were stolen, reused or never changed from the default. Reaching the management interface without those credentials should not be enough on its own.
Exploitation status: CVE-2026-42020 is not in the CISA Known Exploited Vulnerabilities catalog. The supplied data does not confirm active exploitation.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| Totolink | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
All other versions are listed as unaffected by default. The NVD record lists no CPE entries yet, and its status is "Received", so NVD has not finished its analysis.
Patch Status
The supplied records do not mention a vendor patch or fixed firmware version. There is no CISA KEV entry, so there is no federal required action or due date. Until Totolink issues a fix, owners of affected X2000R units should:
- Restrict access to the web management interface, especially from untrusted networks
- Make sure admin credentials are strong and not shared
- Watch Totolink and the Talos advisory for updated firmware
Sources
- NVD, CVE-2026-42020
- Cisco Talos; TALOS-2026-2394
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE)