An authenticated attacker can send a crafted HTTP request with a malicious static_dns1 parameter to the Totolink X2000R router and trigger a stack-based buffer overflow that can lead to arbitrary code execution.
What Is It
CVE-2026-42021 is one of several stack-based buffer overflows (CWE-121) in the formIpv6Setup handler of the router's boa web server. That handler processes static IPv6 network configuration. This CVE covers the static_dns1 parameter. Cisco Talos reported it, and NVD published it on 2026-10-20. The NVD record's status is still "Received," so NVD has not finished its own analysis yet.
The CNA rates it 9.1 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Why It Matters
According to the CNA, the flaw can be reached over the network, the attack is not complex, and no user interaction is needed. A successful attack can lead to arbitrary code execution. The vector also marks the scope as changed, with high impact to confidentiality, integrity and availability. In practice, an attacker who takes over the router this way could affect more than the vulnerable component itself.
The main limit is that the attacker needs high privileges: the request has to be authenticated. That requirement is why the exploitability subscore is only 2.3 while the impact subscore is 6.0. Anyone who already holds administrative web credentials, or can obtain them, has a direct path to running code on the device.
Exploitation status: CVE-2026-42021 is not in the supplied CISA KEV data, so this brief does not claim active exploitation.
What's Vulnerable
- Vendor: Totolink
- Product: X2000R
- Affected firmware:
TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 - Component:
boaweb server,formIpv6Setup(static network configuration) - Parameter:
static_dns1
The CNA marks all other versions as unaffected by default. NVD has not published any CPE matches yet.
Patch Status
The supplied NVD record does not mention a fixed firmware version or a vendor advisory. CISA KEV lists no required action, because the CVE is not in the KEV data provided. Owners of affected X2000R units should check the Talos report and Totolink's support channels for firmware updates. Until fixed firmware is confirmed, treat the listed build as vulnerable.