A critical stack-based buffer overflow in the Totolink X2000R router's web server can lead to arbitrary code execution when an authenticated attacker sends a specially crafted HTTP request through the static_gw parameter.
What Is It
CVE-2026-42024 is one of several stack-based buffer overflows (CWE-121) in the formIpv6Setup static network configuration function of the Totolink X2000R's boa web server. This entry covers the static_gw parameter. Cisco Talos, acting as the CNA, says a specially crafted HTTP request can lead to arbitrary code execution. The attacker has to be authenticated to send the request.
The record was published to NVD on 2026-10-20. NVD lists its status as "Received," so it has not been analyzed yet.
Why It Matters
Talos rates the flaw 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The score breaks down as follows:
- Network attack vector, low complexity: the attacker can reach the bug over the network, and no special conditions are needed.
- High privileges required: the attacker needs an authenticated session with high privileges. This is the main limit on who can exploit it.
- Scope changed: a successful exploit can affect resources beyond the vulnerable component.
- High confidentiality, integrity and availability impact: if an attacker achieves code execution on the device, it could lead to full compromise.
The description says multiple overflows exist in the same function. CVE-2026-42024 is only the static_gw instance, so related CVEs probably cover other parameters in the same code path.
Exploitation status: this CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| Totolink | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
The CNA's default status for this product is "unaffected." Only the firmware build listed above is marked affected. NVD has not assigned any CPEs yet.
Patch Status
The supplied NVD and KEV data does not mention a vendor patch or fixed firmware version. CISA has not set a required action or due date because the CVE is not in KEV. Owners of affected devices should check the Talos advisory and Totolink for firmware updates. Until a fix is available, limit who can log in to the router's web management interface, since exploitation requires high-privilege authenticated access.