TOTOLINK X2000R CVE-2026-28763

Exploitation requires an authenticated session on the X2000R web management interface (boa HTTP server) with sufficient privilege to reach the formMapDelDevice handler, then sending a crafted HTTP request with an oversized hostname value. Limiting factors: valid administrative credentials are mandatory (CVSS PR:H; description states 'authenticated HTTP request'), and the specific firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 must be running. Practical risk rises sharply where the device uses default/unchanged admin credentials or where the web interface is exposed to the WAN/internet; no user interaction is required (UI:N).

Signals are moderately consistent but point to a conditional rather than mass-exploitable threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, score 9.1) describes a network-reachable, low-complexity stack overflow, but the PR:H metric and the description's explicit 'authenticated HTTP request' both confirm that valid high-privilege (admin) credentials are a hard prerequisite - this is the dominant risk-limiting factor. No EPSS score, CISA KEV listing, or POC indicator is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 9.1 is driven by full C/I/A impact plus scope-change, not by exploitation likelihood. The high CVSS should therefore be read as 'critical if an attacker already holds admin access,' which on consumer routers often reduces to post-authentication persistence/code-execution rather than initial compromise - unless the admin credentials are default/weak or paired with an auth-bypass, the real-world priority is moderate. Note a scope discrepancy to verify: the input uses S:C (yielding 9.1), but code execution within the boa web server on a single embedded device arguably shares one security authority (S:U, ~7.2) - see assessed vector below.

An attacker who has authenticated to the TOTOLINK X2000R web interface (boa httpd) as an administrator sends a specially crafted HTTP request to the formMapDelDevice endpoint with an overlong hostname parameter. This overflows a stack buffer (CWE-121), allowing arbitrary code execution on the router, typically as root. No public exploit code is identified at time of analysis; the finding is from a Talos vulnerability report.