EUVD-2026-105341
GHSA-hv4f-3pwg-585p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend crafted formIpv6Setup HTTP request
-
ExploitOverflow static_dns2 stack buffer
-
ExecutionHijack control flow in boa process
-
ImpactExecute arbitrary code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated HTTP request (PR:H) to the boa web server's formIpv6Setup static network-configuration handler, specifically oversizing the static_dns2 parameter; the attacker must therefore possess valid administrative credentials for the X2000R web interface and have network access to it. Limiting factors: the vulnerable formIpv6Setup/static IPv6 configuration page is an administrative function, so prior authentication is mandatory - there is no unauthenticated path in the provided data; exposure is further limited to the specific firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, and risk rises sharply only where the management interface is WAN-exposed or protected by default/weak credentials. |
| Impact | Signals are mixed and point to a serious-but-constrained device vulnerability rather than a mass-exploitation emergency. The Talos CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) indicates a network-reachable, low-complexity bug yielding full compromise, but it explicitly requires high privileges (PR:H) - the description confirms an *authenticated* HTTP request is needed, so this is not a pre-auth internet-wide threat. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active exploitation or widespread automation; exploitation status is 'no public exploit identified at time of analysis.' The S:C (scope-changed) rating that inflates the score to 9.1 is debatable: a stack overflow in the boa web server process that executes code on the same device is more naturally S:U, which would lower the base score - this discrepancy should be verified against the Talos advisory. Net: a genuine arbitrary-code-execution flaw, but real-world risk is gated by the need for valid admin-level credentials (or chaining with a separate auth-bypass/credential-theft bug), making opportunistic mass exploitation unlikely and targeted/post-auth abuse the realistic concern. |
| Exploit ScenarioDerived | An attacker who already holds valid admin credentials to the TOTOLINK X2000R web interface (via default/weak passwords, phishing, or a separate auth bypass) sends a specially crafted HTTP request to the boa formIpv6Setup handler with an oversized static_dns2 value. The overlong value overflows a stack buffer (CWE-121), corrupting the return address and allowing arbitrary code execution on the router. No public exploit code was identified in the provided data, though Talos documented the technical details in TALOS-2026-2395. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Stack-based buffer overflow in the boa web server of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an attacker holding valid administrative credentials to achieve arbitrary code execution by sending a crafted HTTP request that oversizes the static_dns2 parameter to the formIpv6Setup handler. The flaw carries a CVSS 3.1 base score of 9.1, but exploitation is gated by PR:H - the attacker must first authenticate to the web management interface and have network reachability to it, so unauthenticated or internet-wide mass exploitation is not indicated by the available data. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no vendor-released patch has been identified; risk is concentrated on devices whose administrative interface is WAN-exposed or protected by default or weak credentials.
RemediationAI
No vendor-released patch was identified at time of analysis: no fixed firmware version is documented in the available data, so administrators should contact TOTOLINK support and monitor the Talos advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2395 for a corrected X2000R firmware release and upgrade as soon as one is published. Until then, apply compensating controls that address the mandatory authentication prerequisite and the exposure surface: disable WAN-side remote management and block inbound access to the boa web interface (typically TCP 80/443) at the perimeter firewall so the formIpv6Setup handler is reachable only from a trusted LAN segment or management VLAN - the trade-off is loss of remote administration, which should be replaced by VPN access. Replace default and weak administrator credentials with unique strong passwords and, where supported, restrict management access by source IP or disable the IPv6 static-DNS configuration page if it is not in use; note that credential hardening only raises the bar for the PR:H prerequisite and does not remediate the underlying memory-safety flaw, since any authenticated administrator can still trigger the overflow. Add detection for oversized static_dns2 values or unusually long POST bodies to /formIpv6Setup in web-server or IDS logs, and consider retiring or isolating the device if the management interface cannot be segmented away from untrusted networks.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is boa, a compact embedded HTTP server widely used in consumer routers and IoT firmware, running on the TOTOLINK X2000R. The vulnerable code path is formIpv6Setup, the handler that processes the administrative static IPv6 network-configuration page; the static_dns2 form field is copied into a fixed-size stack buffer without adequate length validation, the classic CWE-121 stack-based buffer overflow pattern. Because the overflow occurs on the stack, a sufficiently long static_dns2 value can overwrite saved registers and the return address, giving the attacker control of execution flow within the context of the boa process (typically root on embedded firmware), which is why the report classifies the outcome as arbitrary code execution rather than a simple denial of service. Cisco Talos reported the issue as TALOS-2026-2395. The provided CPE (cpe:2.3:a:totolink:totolink:*:*:*:*:*:*:*:*) is a wildcard product entry and does not itself constrain the version; the only confirmed affected build in the source data is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Note that the supplied vendor-style vector records S:C (scope changed) while the independent assessment uses S:U; the assessed S:U/C:H/I:H/A:H vector is the authoritative characterization here, and the substantive prerequisite - administrative authentication (PR:H) over the network - is the same in both.
Know when TOTOLINK gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity overflow needing admin authentication (PR:H); code executes within the same router device, so S:U rather than Talos's S:C, with full C/I/A impact.
Primary rating from Vendor (talos).
CVSS VectorVendor: talos
DescriptionCVE.org
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.
Executive ViewAI
TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 are exposed to a critical buffer overflow that lets an authenticated administrator with network access to the web management interface execute arbitrary code on the device. No vendor patch or public exploit is currently identified, so leadership attention should focus on devices whose administrative interface is internet-facing or protected by default or weak credentials, where the operational and network-trust impact is highest.
No vendor-released patch identified at time of analysis. Interim mitigations: remove WAN exposure of the web management interface, restrict access to trusted management networks and IP allowlists, rotate and strengthen administrative credentials, disable remote management, segment affected routers, and monitor for suspicious formIpv6Setup/static_dns2 requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Exploit-DB