{"id":"CVE-2026-41222","kind":"vulnerability","aliases":["CVE-2026-41222"],"related":[],"title":"TOTOLINK X2000R router: crafted request overflows stack and runs code","description":"A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Stack overflow (strcpy of url%d POST param, CWE-121) in formParentControl of the boa web server on TOTOLINK X2000R firmware B20250421.1327. Needs admin login (CVSS 9.1, PR:H). Found by Cisco Talos; no fix known.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["boa","firmware","home-network","infrastructure","router","totolink","x2000r"],"not_affected_if":["no-web-admin-exposure","not-x2000r","other-firmware-version","remote-admin-disabled"],"how_to_check":"Router admin page > firmware version; vulnerable if TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Check whether the admin web UI (boa, /boafrm/formLogin) is reachable from WAN or LAN you don't trust.","fix":"No fixed firmware published as of 2026-10-23 (unknown; check totolink.net X2000R download page). Mitigate: disable WAN/remote management, change the admin password, restrict admin UI to trusted hosts, replace the device if no patch arrives.","status":"open","published_at":"2026-10-20T21:17:18+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:10+00:00","updated_at":"2026-10-23T23:14:44+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: crafted request overflows stack and runs code","impact":"high","summary":"The boa web server's formParentControl URL handler on the TOTOLINK X2000R router has a stack-based buffer overflow. An attacker who can log in to the router's web interface can send a crafted HTTP request to run arbitrary code on the device.","category":"infrastructure","who_cares":["totolink","x2000r","home-network","router"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs code on the router with full device control.","analyst_note":"Find the firmware fix version and vendor advisory for X2000R; the source only names firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-firmware-version","no-web-admin-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000478,"input_tokens":2954,"output_tokens":366,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the firmware fix version and vendor advisory for X2000R; the source only names firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.","search":"'-121':37B '-2026':12A,15A '-41222':13A,16A '0.0':87C '9.1':54B 'admin':51B 'arbitrari':97C 'attack':101C 'authent':105C 'b20250421.1327':49B,88C 'base':67C 'boa':19B,42B,74C 'buffer':68C 'cisco':59B 'code':10A,98C 'craft':4A,91C 'cve':11A,14A 'cvss':53B 'cwe':36B 'd':33B 'execut':99C 'exist':71C 'firmwar':20B,48B 'fix':62B 'formparentcontrol':39B,75C 'found':57B 'function':77C 'gh':85C 'h':56B 'home':22B 'home-network':21B 'http':92C,106C 'infrastructur':24B 'known':63B 'lead':95C 'login':52B 'make':103C 'need':50B 'network':23B 'overflow':6A,29B,69C 'param':35B 'post':34B 'pr':55B 'request':5A,93C,107C 'router':3A,25B 'run':9A 'server':44B 'special':90C 'stack':7A,28B,66C 'stack-bas':65C 'strcpi':30B 'talo':60B 'totolink':1A,17A,26B,46B,83C 'totolink-x2000r-gh-v1':82C 'trigger':109C 'url':32B,76C 'v1':86C 'version':80C 'vulner':70C,111C 'web':43B 'x2000r':2A,18A,27B,47B,79C,84C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-41222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41222","severity":null,"published_at":"2026-10-20T21:17:18+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-41222:399","url":null,"severity":null,"published_at":"2026-10-23T23:14:44+00:00","modified_at":"2026-10-23T23:14:44+00:00","first_seen_at":"2026-10-23T23:14:44+00:00","fetched_at":"2026-10-23T23:14:44+00:00","note":"Read Talos TALOS-2026-2392 (primary). No vendor fix or advisory found; vendor acknowledged 2026-06-25 but no patch listed. Not exploited, no public PoC (VulDB). Sibling X2000R CVEs share the same build."}],"documents":[{"id":1855,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2392","title":"TALOS-2026-2392 Totolink X2000R formParentControl stack overflow","kind":"advisory","source":"analyst","text":"Talos report: strcpy of POST param url%d into 0x100 stack buffer in formParentControl (/boafrm/formParentControl), no length check; authenticated; only B20250421.1327 confirmed vulnerable. Timeline: vendor notified 2026-06-16, acknowledged 2026-06-25, follow-ups through 2026-09-15; no patch noted. Crash shows PC control (0x42424242).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1857,"url":"https://vuldb.com/vuln/423050","title":"VulDB VDB-423050","kind":"other","source":"analyst","text":"VulDB: CVE-2026-41222, remote, no exploit available.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}