TOTOLINK X2000R CVE-2026-42021

Exploitation requires an authenticated session with administrative privileges (CVSS PR:H) on the TOTOLINK X2000R web management interface, plus network reachability to the boa HTTP server (AV:N, typically the LAN-side admin interface unless remote management is enabled). The specific trigger is a crafted HTTP request to the formIpv6Setup static network configuration function with an oversized static_dns1 parameter. Limiting factors: the requirement for valid admin credentials is the primary gate, meaning realistic risk is highest where default/weak credentials, credential reuse, or a separate auth bypass are present, or where the admin interface is exposed to the WAN; it is not a remote-unauthenticated flaw against a default, properly-credentialed device.

This is a genuinely high-impact vulnerability but NOT a top-tier emergency priority given current signals. The CVSS 9.1 is driven by the scope change (S:C) plus full C/I/A impact and network attack vector (AV:N) with low complexity (AC:L), yielding arbitrary code execution. However, the single most important mitigating signal is PR:H - exploitation requires an authenticated session with high (effectively administrative) privileges on the router, which substantially narrows the realistic attacker population. No CISA KEV listing and no EPSS score were provided, and no public exploit was referenced, so there is no evidence of active or widespread exploitation at this time. The signals are internally consistent: the Talos advisory describes an 'authenticated HTTP request,' which aligns with the PR:H in the CVSS vector - there is no network-vs-local or auth contradiction to flag. The practical risk profile is 'post-authentication device takeover': dangerous where attackers can obtain or default credentials (weak/default admin passwords, credential reuse, or chaining from an auth-bypass bug), but gated behind authentication in a default, properly-credentialed deployment. EPSS and KEV data are absent from the input, so widespread-exploitation probability cannot be quantified and should be treated as unknown rather than low.

An attacker who has obtained admin credentials for the TOTOLINK X2000R web interface (via default/weak passwords, phishing, or credential reuse) sends a specially crafted HTTP request to the boa web server's formIpv6Setup handler with an oversized static_dns1 parameter. This overflows a stack buffer (CWE-121) and allows arbitrary code execution on the router. No public proof-of-concept was referenced in the provided data, and the attack requires a valid authenticated session.