An authenticated attacker can send a crafted HTTP request with a malicious static_ipv6 parameter to the Totolink X2000R's web interface, overflow a stack buffer and run arbitrary code.
What Is It
CVE-2026-42023 is one of several stack-based buffer overflows (CWE-121) in the formIpv6Setup static network configuration feature of the Totolink X2000R's boa web server. This CVE covers the static_ipv6 parameter. A specially crafted, authenticated HTTP request can trigger the overflow and lead to arbitrary code execution.
Cisco Talos, acting as the CNA, reported the issue. NVD published the record on 2026-10-20, and its status is currently "Received," meaning NVD has not yet analyzed it.
Why It Matters
Talos rates the flaw CVSS 3.1 9.1 (CRITICAL) with the vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable with low attack complexity and no user interaction
- High privileges required. The attacker must already be authenticated, which is the main limiting factor.
- Scope changed. A successful exploit can affect resources beyond the vulnerable component.
- High impact to confidentiality, integrity and availability
Code execution on a router puts a device that sits at the network edge under the attacker's control. The CVE is one of several overflows in the same function, so defenders should expect related CVEs for other parameters.
Exploitation status: This CVE is not in the CISA Known Exploited Vulnerabilities catalog. The supplied data does not confirm active exploitation.
What's Vulnerable
| Field | Value |
|---|---|
| Vendor | Totolink |
| Product | X2000R |
| Affected firmware | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
| Component | boa web server, formIpv6Setup handler |
| Parameter | static_ipv6 |
The CNA's default status is "unaffected," so only the firmware build listed above is confirmed vulnerable. NVD does not list any CPEs yet.
Patch Status
The supplied NVD record does not mention a fixed firmware version or a vendor patch. Because the CVE is not in KEV, CISA has not issued a required action or due date. Until a fix is confirmed:
- Check the Talos advisory below for vendor coordination details and fix status.
- Limit who can reach the device's web management interface.
- Protect administrative credentials, since exploitation requires an authenticated request.
Sources
- NVD: CVE-2026-42023
- Cisco Talos: TALOS-2026-2395
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE)