TOTOLINK X2000R CVE-2026-42023

Requires an authenticated session on the router's boa (httpd) web management interface, after which the attacker sends a crafted HTTP request to the formIpv6Setup static network configuration handler with an oversized static_ipv6 parameter to overflow a stack buffer. Limiting factors: valid administrative credentials are required (CVSS PR:H), and the affected formIpv6Setup/static IPv6 configuration path must be reachable - in practice the management interface is often LAN-only unless remote administration is enabled. The practical barrier is weakened on consumer routers where default or weak admin passwords are common. Confirmed only for firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.

The input CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) describes a network-reachable, low-complexity flaw with full confidentiality/integrity/availability impact and a changed scope, which drives the Critical score. The decisive mitigating signal is PR:H: exploitation requires an already-authenticated session on the device's web management interface, so this is not a pre-auth internet worm candidate. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - the 9.1 is therefore a high-severity-but-privilege-gated issue rather than a confirmed widespread threat. Signals are broadly consistent, but two points warrant scrutiny: (1) the scope flag S:C is debatable, since the overflow executes code within the same boa web server/device authority rather than crossing into a separate security domain - this inflates the base score; and (2) on consumer SOHO routers like the X2000R, the PR:H barrier is frequently undermined by default or weak admin credentials and by internet-exposed management panels, so real-world attacker effort may be lower than PR:H implies. Net: genuine device-takeover risk where management access is obtainable, but not an unauthenticated mass-exploitation priority on current evidence.

An attacker who has obtained web-admin access to a TOTOLINK X2000R (via default/weak credentials, credential reuse, or an exposed management interface) submits a crafted HTTP request to the boa formIpv6Setup handler with an oversized static_ipv6 value, overflowing a stack buffer and executing arbitrary code on the router. No public exploit code was identified at the time of analysis, but the device typically runs its web server with high privilege, so successful exploitation yields full control of the router.