{"id":"CVE-2026-28763","kind":"vulnerability","aliases":["CVE-2026-28763"],"related":[],"title":"TOTOLINK X2000R router: stack overflow in device hostname handler allows code execution","description":"A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Stack-based buffer overflow in the boa web server on the TOTOLINK X2000R. formMapDelDevice copies the POST parameter 'hostname' onto a 0x40-byte stack buffer with strcpy, and it only runs when 'hostnameAdd' is non-empty. An authenticated admin session can overwrite the return address and get code execution on the router. Talos found it, and the vendor has not published a fix.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R firmware","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["boa","embedded","infrastructure","router","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","not-x2000r","other-firmware-versions","web-admin-disabled"],"how_to_check":"In the router admin UI (System > Firmware / Status), read the firmware version. Build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable. Other builds are untested, so treat them as possibly affected. Also check whether the admin web interface is reachable from WAN (remote management / port-forwarding of the admin port) and whether the default admin password is still set.","fix":"No fixed firmware is known. Talos disclosure timeline shows no patch as of 2026-09-15. Mitigate: turn off WAN/remote management, restrict the admin UI to a trusted LAN segment, change default admin credentials, and watch totolink.net for a newer X2000R firmware. Consider replacing the device if no patch ships.","status":"open","published_at":"2026-10-20T21:17:18+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:12+00:00","updated_at":"2026-10-23T23:15:46+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: stack overflow in device hostname handler allows code execution","impact":"high","summary":"A stack-based buffer overflow in the boa web server's formMapDelDevice hostname handler on the TOTOLINK X2000R router can be triggered by a crafted HTTP request. An attacker who gets past authentication can run arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","router","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"code runs on the router with full device control","analyst_note":"Check the vendor or NVD advisory for a fixed firmware build and confirm whether the admin web interface is reachable from WAN; the sources only name firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-firmware-versions","web-admin-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000493,"input_tokens":2967,"output_tokens":392,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor or NVD advisory for a fixed firmware build and confirm whether the admin web interface is reachable from WAN; the sources only name firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","search":"'-2026':14A,17A '-28763':15A,18A '0.0':120C '0x40':54B '0x40-byte':53B 'address':78B 'admin':72B 'allow':10A 'arbitrari':130C 'attack':134C 'authent':71B,138C 'b20250421.1327':121C 'base':33B,100C 'boa':22B,38B,107C 'buffer':34B,57B,101C 'byte':55B 'code':11A,81B,131C 'copi':46B 'craft':124C 'cve':13A,16A 'devic':7A 'embed':23B 'empti':69B 'execut':12A,82B,132C 'exist':104C 'firmware':21A 'fix':96B 'formmapdeldevic':45B,108C 'found':87B 'function':110C 'get':80B 'gh':118C 'handler':9A 'host':28B 'hostnam':8A,50B,109C 'hostnameadd':65B 'http':125C,139C 'infrastructur':24B 'lead':128C 'make':136C 'non':68B 'non-empti':67B 'onto':51B 'overflow':5A,35B,102C 'overwrit':75B 'paramet':49B 'post':48B 'publish':94B 'request':126C,140C 'return':77B 'router':3A,25B,85B 'run':63B 'self':27B 'self-host':26B 'server':40B 'session':73B 'special':123C 'stack':4A,32B,56B,99C 'stack-bas':31B,98C 'strcpi':59B 'talo':86B 'totolink':1A,19A,29B,43B,116C 'totolink-x2000r-gh-v1':115C 'trigger':142C 'v1':119C 'vendor':91B 'version':113C 'vulner':103C,144C 'web':39B 'x2000r':2A,20A,30B,44B,112C,117C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28763","severity":null,"published_at":"2026-10-20T21:17:18+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-28763:404","url":null,"severity":null,"published_at":"2026-10-23T23:15:46+00:00","modified_at":"2026-10-23T23:15:46+00:00","first_seen_at":"2026-10-23T23:15:46+00:00","fetched_at":"2026-10-23T23:15:46+00:00","note":"Read Talos TALOS-2026-2389 (primary). Only build B20250421.1327 confirmed vulnerable; no fixed firmware; vendor acknowledged 2026-06-25 but no patch by 2026-09-15. No exploitation or public PoC found (Talos gives crash details only); did not search X."}],"documents":[{"id":1859,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2389","title":"TALOS-2026-2389 Totolink X2000R formMapDelDevice stack overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}