An authenticated attacker can send a crafted HTTP request through the static_dns2 parameter of the Totolink X2000R's boa web server to trigger a stack-based buffer overflow and run arbitrary code.
What Is It
CVE-2026-42022 is one of several stack-based buffer overflows (CWE-121) in the formIpv6Setup static network configuration handler. That handler runs in the boa web server on the Totolink X2000R router. This CVE covers the static_dns2 parameter only. Cisco Talos reported it and serves as the CNA, publishing the details in advisory TALOS-2026-2395.
According to the NVD record, "a specially crafted HTTP request can lead to arbitrary code execution." The attacker must be authenticated to trigger it.
Why It Matters
Talos rates the flaw 9.1 CRITICAL under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H):
- Network-reachable with low attack complexity
- No user interaction required
- Scope changed: a successful exploit can affect resources beyond the vulnerable component
- High impact to confidentiality, integrity and availability
The main limit is that the attacker needs high privileges, meaning authenticated access to the web interface. Even so, code execution on a router can give the attacker full control of the device and the traffic passing through it.
Exploitation status: No CISA KEV entry was supplied for this CVE, so KEV does not confirm active exploitation. The NVD record is in "Received" status and has not been fully analyzed yet.
What's Vulnerable
| Field | Value |
|---|---|
| Vendor | Totolink |
| Product | X2000R |
| Affected firmware | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
| Component | boa web server, formIpv6Setup (static network configuration) |
| Parameter | static_dns2 |
The CNA lists only this one firmware build as affected and marks everything else as unaffected by default. NVD lists no CPE entries yet.
Patch Status
The supplied records contain no vendor patch, fixed firmware version or CISA required action. There is no KEV listing, so no federal remediation deadline applies. Administrators running the affected build should check the Talos advisory and Totolink for updated firmware. Until a fix is confirmed, limit who can authenticate to and reach the router's management interface.