Critical Stack Overflow in TOTOLINK X2000R Router Web Interface (CVE-2026-42025)

"CVE-2026-42025 is a critical (CVSS 9.1) stack-based buffer overflow in the TOTOLINK X2000R's boa web server. An authenticated attacker can exploit it with a specially crafted HTTP request to run arbitrary code."

CVE-2026-42025 is a critical (CVSS 9.1) stack-based buffer overflow in the TOTOLINK X2000R's boa web server. An authenticated attacker can exploit it with a specially crafted HTTP request to run arbitrary code.

What Is It

CVE-2026-42025 is a stack-based buffer overflow (CWE-121) in the formIpv6Setup dhcp_dns functionality of the boa web server on the TOTOLINK X2000R. It affects the dhcp_dns1 parameter. Cisco Talos, which reported the issue, describes it as one of multiple exploitable stack-based buffer overflows in this functionality. According to the NVD description, a specially crafted HTTP request can lead to arbitrary code execution. The attacker must send an authenticated HTTP request to trigger it.

Why It Matters

The flaw has a CVSS v3.1 base score of 9.1 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Key points from the score:

Network-reachable, with low attack complexity and no user interaction needed.
High privileges required, so the attacker needs valid authenticated access to the web interface.
Scope changed, with high impact to confidentiality, integrity and availability. A successful attack can affect resources beyond the vulnerable component.

Because the flaw sits in a router's management interface, code execution means an attacker could control a network edge device.

The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE. The supplied data does not confirm active exploitation.

What's Vulnerable

Vendor: TOTOLINK
Product: X2000R
Affected version: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
Component: boa web server, formIpv6Setup dhcp_dns handler, dhcp_dns1 parameter

The CNA record lists all other versions as unaffected by default. NVD has not published any CPE mappings yet. The record status is "Received," which means NVD has not finished analyzing it.

Patch Status

The supplied NVD record contains no fixed firmware version or vendor advisory, and there is no CISA KEV entry, so there is no federally mandated required action. Administrators of affected X2000R devices should check the Talos report and TOTOLINK for updated firmware. Until a fix is confirmed, limit access to the router's web management interface to trusted users and networks.

Sources

NVD – CVE-2026-42025
Cisco Talos – TALOS-2026-2396
CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE)