TOTOLINK X2000R CVE-2026-41222

Requires an authenticated HTTP request to the boa web server's formParentControl endpoint (the parental-control feature) with a maliciously oversized url parameter on a TOTOLINK X2000R running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. The primary limiting factor is authentication (PR:H in the source vector) - the attacker must already possess valid admin/web-interface credentials or exploit weak/default credentials; real-world risk rises sharply where the management interface is reachable from the WAN/internet and falls where it is LAN-only behind unique credentials. No user interaction and no non-default feature toggle are needed beyond reaching the authenticated web UI.

This is a high-severity stack-based buffer overflow (CWE-121) in the boa web server's formParentControl url handler on the TOTOLINK X2000R router, carrying a vendor/source CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The network vector, low attack complexity, and no-user-interaction profile make the request itself trivial to deliver, and successful exploitation yields arbitrary code execution with full confidentiality/integrity/availability impact - effectively total device takeover. The single meaningful brake is authentication: PR:H in the provided vector indicates a privileged (authenticated) HTTP request is required, which aligns with the description ('An attacker can make an authenticated HTTP request'). There is no CISA KEV listing and no EPSS score or public exploit indicated in the supplied data, so despite the high CVSS this is NOT confirmed to be under active exploitation or widely weaponized. One signal tension worth noting: the source vector uses S:C (scope changed) and PR:H, but for an embedded router where the boa server typically runs as root and there is effectively one administrative web role, PR:L and S:U are at least as defensible - see assessed vector below. Net: a genuinely dangerous RCE on affected hardware, but real-world risk is gated by the authentication requirement and the relatively limited deployment footprint of this consumer router model, so prioritize patching/exposure-reduction for affected TOTOLINK X2000R devices (especially any with internet-exposed admin interfaces) rather than treating it as a mass-exploitation emergency.

An attacker who has obtained (or guessed/default) credentials for the TOTOLINK X2000R web admin sends a single crafted HTTP request to the boa server's formParentControl endpoint with an overlong url parameter, overflowing a stack buffer and executing arbitrary code on the device. Because the vector is network-based with low complexity and no user interaction, the request can be fired directly at the management interface; no public exploit code was identified in the provided data, though Talos has published a detailed vulnerability report (TALOS-2026-2392).