TOTOLINK X2000R CVE-2026-42020

Exploitation requires (1) valid authentication to the router's boa web management interface (PR:H per CVSS), and (2) the ability to reach that HTTP interface over the network. The specific trigger is an oversized/crafted value supplied to the pppoe_dns2 parameter in the formIpv6Setup PPPoE configuration handler. Limiting factors: the attacker must already hold admin-level web credentials, so default/unchanged passwords or a prior credential compromise materially raise risk; exposure is further constrained if the web interface is not reachable from the WAN (typical secure configurations restrict it to LAN). It affects the specific TOTOLINK X2000R firmware build identified by Talos.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) signals network-reachable, low-complexity arbitrary code execution, but it is gated by PR:H - the description explicitly requires an authenticated HTTP request, so this is NOT an unauthenticated remote takeover. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no evidence of active exploitation or weaponization; the real-world threat is bounded by the authentication requirement and by the limited deployment footprint of a consumer TOTOLINK router. I disagree with the input's Scope:Changed metric: code execution inside the boa web server on an embedded router compromises the same device/security authority, so S:U is more defensible, which would lower the score to roughly 7.2 (High) rather than 9.1 (Critical) - verify scope rationale with Talos. Net assessment: a genuine high-severity post-authentication RCE worth patching on exposed or multi-user devices, but a lower operational priority than a pre-auth internet-facing flaw, especially absent any exploitation signal.

An attacker who has obtained valid router credentials (default/weak admin password, prior phishing, or an authenticated foothold on the LAN) sends a crafted HTTP request to the boa web server's formIpv6Setup PPPoE handler with an oversized pppoe_dns2 value, overflowing a stack buffer and executing arbitrary code - typically as root on these embedded devices. No public exploit code is identified at time of analysis, but the vulnerability class (CWE-121) is reliably exploitable once credentials are held. Low attack complexity (AC:L) means no special timing or race conditions are needed.