An authenticated attacker can send a crafted HTTP request to overflow a stack buffer through the dhcp_dns2 parameter in the TOTOLINK X2000R's boa web server, which can lead to arbitrary code execution.
What Is It
CVE-2026-42026 is a stack-based buffer overflow (CWE-121) in the formIpv6Setup handler of the boa web server on the TOTOLINK X2000R. The flaw is in the dhcp_dns code path and is triggered through the dhcp_dns2 parameter.
Cisco Talos, the CNA that assigned the ID, says the advisory covers multiple stack-based buffer overflows in this same code path. This CVE is the one for the dhcp_dns2 parameter. Talos says a specially crafted HTTP request can lead to arbitrary code execution. The attacker must be authenticated to send it.
NVD published the record on 2026-10-20. Its status is "Received," which means NVD has not analyzed it yet.
Why It Matters
Talos rates the flaw 9.1 (Critical) under CVSS 3.1:
- Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Attack vector: Network
- Attack complexity: Low
- Privileges required: High
- User interaction: None
- Scope: Changed
- Impact: High for confidentiality, integrity, and availability
The high-privilege requirement limits who can exploit it: the attacker needs authenticated access to the web interface. Even so, the score is critical because the attack is low-complexity over the network, the scope is changed, and code execution compromises the device completely.
Exploitation status: The supplied CISA KEV entry is empty. KEV does not confirm active exploitation of this CVE at this time.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| TOTOLINK | X2000R | TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
- The record's default status is "unaffected," so only the firmware build listed above is confirmed vulnerable.
- NVD has not assigned any CPE entries yet.
Patch Status
The supplied NVD record does not mention a vendor patch or fixed firmware version. There is no KEV entry, so CISA has not issued a required action or remediation deadline.
Owners of the X2000R running the affected build should:
- Read the Talos advisory for vendor coordination details and any fixed firmware.
- Watch TOTOLINK for a firmware update.
Exploitation needs authenticated access, so limiting who can reach the web interface and use administrative credentials reduces exposure.
Sources
- Cisco Talos: TALOS-2026-2396
- NVD: CVE-2026-42026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE)