Totolink X2000R CVE-2026-42024

Exploitation requires an authenticated, administrator-level session on the X2000R's boa web management interface (CVSS PR:H), after which a crafted HTTP request to the formIpv6Setup static network configuration endpoint with an overlong static_gw value triggers the overflow. Limiting factors: the attacker must first hold valid admin credentials or hijack an admin session, so the interface being exposed to the attacker's network and weak/default credential hygiene are the practical enablers. The specific affected firmware is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; other firmware/hardware revisions are not confirmed affected from the available data.

This is a genuinely serious vulnerability but with an important gating factor. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C) and 9.1 score are driven by network reachability, low complexity, no user interaction, full CIA impact, and a scope change - but the PR:H metric confirms that successful exploitation requires an already-authenticated, high-privilege (administrator) session on the device, which substantially lowers real-world risk versus a pre-auth RCE. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so by the precision rules this is 'no public exploit identified at time of analysis'; the only source is a Talos vulnerability report (TALOS-2026-2395), which typically includes technical detail but not a weaponized exploit. There is no SSVC decision data provided. Net: this warrants prompt patching on exposed/managed devices, but because exploitation is post-authentication, the realistic threat is an attacker who has already obtained admin credentials (default/weak passwords, credential reuse, or a chained pre-auth bug) escalating to persistent code execution on the router - not mass untargeted exploitation. The scope-change claim (S:C) is debatable for an on-device buffer overflow and I assess it as S:U below.

An attacker who has obtained administrative access to the TOTOLINK X2000R web interface (e.g., via default/weak credentials or credential reuse) submits a specially crafted HTTP request to the boa formIpv6Setup handler with an oversized static_gw parameter. The overlong value overflows a fixed-size stack buffer (CWE-121), overwriting the return address and leading to arbitrary code execution on the router, typically as root. No public exploit was identified at time of analysis; the vulnerability is documented by Cisco Talos.