TOTOLINK X2000R CVE-2026-41223

Exploitation requires (1) network reachability to the device's boa HTTP management interface and (2) a valid authenticated session with sufficient privilege to invoke the formMapDelDevice function - the description explicitly states 'An attacker can make an authenticated HTTP request,' matching the PR:H metric. The specific trigger is an overlong value in the 'macstr' parameter of the formMapDelDevice endpoint. Limiting factors that reduce real-world risk: administrative authentication is mandatory (no unauthenticated path described), exploitation is confined to the specific firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, and exposure depends on whether the management interface is reachable from the attacker's network position (LAN by default, far higher risk if WAN/remote management is enabled). No end-user interaction is required.

The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1 Critical) describes a network-reachable, low-complexity flaw yielding full compromise, but the PR:H metric and the description ('An attacker can make an authenticated HTTP request') confirm that valid administrative credentials are a hard prerequisite - this is NOT an unauthenticated remote takeover, which materially lowers real-world risk versus the raw 9.1 score. No EPSS score was provided, there is no CISA KEV listing, and no public exploit/POC is referenced (only a Talos vulnerability report), so there is no public exploit identified at time of analysis and no evidence of active or automatable mass exploitation. The authentication barrier means the practical threat is primarily post-authentication privilege escalation to code execution (e.g., an attacker who has phished/brute-forced the admin panel, or a lower-trust user on a shared device), or chaining with a separate auth-bypass. Conflicting signal to note explicitly: the vector asserts S:C (scope change), but a stack overflow in the boa HTTP daemon most plausibly executes within that daemon's own context rather than crossing a security boundary, so the scope claim is questionable and should be verified against the Talos report. Net: a genuine critical-severity code-execution bug, but its exploitation is gated by administrative authentication, making it a high-priority patch for exposed devices rather than a wormable internet-wide emergency.

An attacker who already possesses valid administrative credentials to a TOTOLINK X2000R router (obtained via default/weak passwords, phishing, or a separate auth bypass) sends a crafted HTTP request to the boa server's formMapDelDevice handler with an overlong 'macstr' parameter. The oversized value overflows a stack buffer (CWE-121), overwriting the return address and allowing execution of arbitrary code on the device. No public proof-of-concept is referenced; discovery is credited to Cisco Talos (TALOS-2026-2390).