CVE-2026-42025

Received Received - Intake

Stack-Based Buffer Overflow in TOTOLINK X2000R Firmware

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Talos

Description

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-42025

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	Totolink	TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This is a stack-based buffer overflow vulnerability in the TOTOLINK X2000R router firmware. It exists in the formIpv6Setup function's dhcp_dns handling. An attacker can send a specially crafted HTTP request with a malicious dhcp_dns1 parameter to trigger a buffer overflow. This can lead to arbitrary code execution on the device. The vulnerability requires authentication to exploit.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable TOTOLINK X2000R devices with firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Inspect network traffic for HTTP requests targeting the dhcp_dns1 parameter in the formIpv6Setup functionality. Look for malformed or unusually large payloads in these requests.

Impact Analysis

If exploited, this vulnerability allows an attacker to execute arbitrary code on your TOTOLINK X2000R router. This could lead to full device compromise, allowing the attacker to take control of your network traffic, steal sensitive data, or use your router as part of a botnet. Since it requires authentication, attackers would need valid credentials or to bypass authentication mechanisms.

Mitigation Strategies

Immediately update the TOTOLINK X2000R firmware to a patched version if available. Disable unauthenticated HTTP access if possible. Restrict network access to the device to trusted sources only. Monitor for suspicious HTTP requests targeting the dhcp_dns1 parameter.

Hi! I’m here to help you understand CVE-2026-42025. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70