EUVD-2026-105339
GHSA-6667-35q5-27x8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliveryCraft HTTP request with oversized dhcp_dns2
-
ExploitOverflow stack buffer in formIpv6Setup
-
ExecutionExecute arbitrary code on device
-
ImpactFull router compromise and pivot
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session to the X2000R router's boa-based web management interface (PR:H), then an HTTP request to the formIpv6Setup / DHCP DNS configuration endpoint carrying an oversized dhcp_dns2 parameter that overflows a stack buffer. Limiting factors: the attacker must hold valid administrative credentials (or chain this with default-credential use or a separate authentication bypass), and the request targets the specific IPv6 setup feature on the affected firmware build. Exploitation is constrained to the specific firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and does not work against unauthenticated attackers in a default credential-protected configuration. |
| Impact | This is a stack-based buffer overflow (CWE-121) in the TOTOLINK X2000R router's boa web server (formIpv6Setup, dhcp_dns2 parameter) that can yield arbitrary code execution. The input CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) and the description agree on the key constraint: exploitation requires an AUTHENTICATED HTTP request (PR:H), so this is not an unauthenticated internet-facing bug despite the network attack vector. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore moderated: an attacker must first obtain valid administrative credentials to the router's web interface, after which arbitrary code execution (effectively full device takeover) is realistic given AC:L. The S:C (scope change) claim in the input is debatable - code execution occurs within the boa server's own authority on the device, and I independently assess S:U, which lowers the honest base score; this discrepancy should be verified against the Talos advisory. Net: a serious code-execution flaw but gated behind authentication and currently without known exploitation, making it a patch-soon rather than emergency item for most environments. |
| Exploit ScenarioDerived | An attacker who has obtained valid admin credentials (via default/weak passwords, credential reuse, phishing, or a chained auth bypass) sends a specially crafted HTTP request to the formIpv6Setup DHCP DNS handler with an oversized dhcp_dns2 value, overflowing a stack buffer and executing arbitrary code on the router. No public POC is identified in the provided data, but Talos has published a vulnerability report (TALOS-2026-2396) describing the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Stack-based buffer overflow in the TOTOLINK X2000R router's boa web management server allows an authenticated administrator to achieve arbitrary code execution by sending a crafted HTTP request to the formIpv6Setup endpoint carrying an oversized dhcp_dns2 parameter. Only firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed affected, and the attack requires a valid high-privilege session (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N) on the device's web interface, meaning real-world exploitation generally depends on default-credential reuse or chaining with a separate authentication bypass. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released fix is confirmed in the available data.
RemediationAI
No vendor-released patch identified at time of analysis: the only reference is the Talos report TALOS-2026-2396 (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2396), which documents the flaw but does not supply a fixed firmware version, so confirm remediation status with TOTOLINK support and monitor that advisory for an updated firmware image before relying on any release. Until a fix is published, the highest-value control is reducing reachability of the boa management interface: disable WAN-side HTTP/HTTPS administration and restrict the web UI to a dedicated management VLAN or an explicit allow-list of administrator source IPs, accepting that this blocks legitimate remote administration and requires out-of-band access for support. Eliminate the credential prerequisite by rotating the default administrator password to a unique, strong secret and, where the firmware permits, creating non-default admin accounts, since the attack requires PR:H and public tooling typically pairs this bug with default-credential reuse. For organizations that must keep the UI reachable, deploy an inline IPS/WAF or reverse proxy rule that rejects POSTs to the IPv6 setup endpoint whose dhcp_dns2 (and dhcp_dns) parameter exceeds the expected DNS address length, understanding that this is signature-dependent and can be bypassed by encoding tricks. Additionally, segment the router so a compromised management session cannot pivot to internal networks, and alert on anomalous requests to formIpv6Setup or on unexpected process restarts and outbound connections from the device, which can indicate a failed or successful exploitation attempt.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is boa, a compact single-threaded embedded HTTP server widely used in consumer routers and IoT firmware, which dispatches URL-encoded form parameters to CGI-style C handlers. In the X2000R IPv6 configuration workflow, the formIpv6Setup handler reads the attacker-supplied dhcp_dns2 value (a DHCP-advertised DNS server address) and copies it into a fixed-size stack buffer without validating its length, the classic CWE-121 stack-based buffer overflow pattern. Because the overflow occurs before any semantic validation of the value, an over-long string can overwrite adjacent stack memory including saved registers and the return address, allowing an authenticated attacker to redirect execution and, on these uClibc/MIPS-class firmware images where stack canaries and full ASLR are frequently absent, obtain reliable arbitrary code execution as the web server's privileged process. The vulnerability class is a memory-safety defect in C string handling rather than a logic flaw, so input-length enforcement, not authentication redesign, is the core fix; exploitation is bound to the specific firmware build because stack layout and handler offsets differ between releases. The supplied CPE string (cpe:2.3:a:totolink:totolink:*:*:*:*:*:*:*:*) is fully wildcarded and does not itself pin a version, so product/version scoping rests on the reported firmware identifier and the Talos advisory TALOS-2026-2396.
Know when TOTOLINK gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Authenticated admin HTTP request keeps PR:H with AV:N/AC:L; code execution runs within the web server's own device authority so S:U rather than S:C, with full C/I/A impact.
Primary rating from Vendor (talos).
CVSS VectorVendor: talos
DescriptionCVE.org
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.
Executive ViewAI
CVE-2026-42026 is a critical buffer overflow in the TOTOLINK X2000R router's web management server that lets an authenticated administrator execute arbitrary code on the device, potentially turning a branch or remote-office edge device into a network foothold. The issue is confirmed only on firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, and exploitation requires a valid high-privilege session, so practical risk rises where default credentials are reused or an authentication bypass is available. No public exploit was identified at time of analysis and no vendor-released patch was identified at time of analysis, so leadership should treat exposed units as unpatched and prioritize inventory, access restriction, and replacement planning.
No vendor-released patch identified at time of analysis; interim mitigations include restricting the boa web management interface to trusted networks or VPN, enforcing unique strong administrator credentials and removing defaults, disabling internet-facing remote management, segmenting affected routers on isolated management VLANs, blocking suspicious formIpv6Setup or dhcp_dns2 requests at the network edge, and monitoring device logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Rated critical severit
TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via th
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Rated critical s
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
Exploit-DB