TOTOLINK X2000R EUVD-2026-105346

Exploitation requires an authenticated session to the router's boa web management interface and access to the parental-control feature, specifically a crafted HTTP request to the formParentControl handler carrying an oversized 'deviceName' parameter that overflows a stack buffer. The primary limiting factor is the high privilege requirement (PR:H) - the attacker must hold valid administrator credentials, so realistic exploitation depends on default/weak admin passwords, credential reuse, or chaining with a separate authentication bypass. Risk rises sharply where the web admin interface is exposed to the WAN/internet rather than LAN-only.

This is a genuinely high-impact vulnerability but NOT a top-tier emergency, and the signals partially conflict with the headline 9.1 score. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) describes network-reachable, low-complexity arbitrary code execution, but critically requires high privileges (PR:H) - i.e. the attacker must already be an authenticated administrator of the router, which the description confirms ('authenticated HTTP request'). The 9.1 is inflated largely by the S:C (scope-changed) choice; on an embedded router where the boa web server IS the device's primary authority, a more conservative S:U assessment yields a High-but-not-Critical score. No EPSS probability, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore moderated: exploitation presupposes credentialed admin access, which on consumer routers is most realistically obtained via default/weak credentials, credential reuse, or chaining with a separate authentication-bypass bug. Treat this as a credible device-takeover primitive worth patching on exposed/managed fleets, but not a drive-by unauthenticated internet worm risk on its own.

An attacker who has obtained administrative credentials to a TOTOLINK X2000R (e.g. via default passwords, phishing, or a chained auth bypass) sends a specially crafted HTTP request to the boa web server's formParentControl endpoint with an oversized deviceName value. The overlong value overflows a fixed-size stack buffer (CWE-121), overwriting the return address and leading to arbitrary code execution on the router, typically as a privileged process. No public exploit code is identified at time of analysis, though Talos has documented the technical details.