TOTOLINK X2000R CVE-2026-42025

Exploitation requires the attacker to first authenticate to the X2000R administrative web interface (boa server) - the description explicitly states an authenticated HTTP request is needed, and the CVSS vector's PR:H confirms high-privilege access is a prerequisite. The specific trigger is an oversized/malformed value in the dhcp_dns1 parameter of the formIpv6Setup (dhcp_dns) IPv6 setup functionality. Limiting factors: valid admin credentials are mandatory (no unauthenticated path), and exploitation is confined to the affected firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; practical risk is highest where the management interface is reachable from untrusted networks or protected only by default/weak credentials. No end-user interaction beyond the attacker's own authenticated request is required (UI:N).

This is a stack-based buffer overflow (CWE-121) in the boa web server's formIpv6Setup dhcp_dns handler of the TOTOLINK X2000R router, leading to arbitrary code execution. The input CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) indicates network-reachable, low-complexity exploitation but explicitly requires high privileges (PR:H) - the attacker must already be authenticated to the router's administrative web interface, which materially lowers real-world risk versus an unauthenticated RCE. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The Scope:Changed (S:C) assignment inflates the score to 9.1; for a buffer overflow executing within the same device/security authority as the vulnerable boa server, S:U is more defensible, which would reduce the base score to ~7.2 - treat the 9.1 as somewhat optimistic and verify scope with the Talos advisory (TALOS-2026-2396). Net: a genuinely serious post-authentication RCE on affected hardware, but the PR:H requirement and absence of KEV/EPSS/POC signals make it a moderate rather than drop-everything emergency priority, most relevant where the admin interface is exposed or credentials are weak/default.

An attacker who has obtained administrative access to the X2000R web interface (via default/weak credentials, credential reuse, or an exposed management port) sends a specially crafted HTTP request to the formIpv6Setup endpoint with an oversized dhcp_dns1 value. The overlong parameter overflows a stack buffer in the boa web server, allowing arbitrary code execution on the device, typically as root. No public exploit code is identified at time of analysis.