{"id":"CVE-2026-41223","kind":"vulnerability","aliases":["CVE-2026-41223"],"related":[],"title":"TOTOLINK X2000R router: stack overflow in device-delete handler allows code execution","description":"A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.","summary":"Stack buffer overflow in the TOTOLINK X2000R web interface. The formMapDelDevice handler passes the macstr POST parameter to /bin/map_del_device, which strcpy's it onto the stack. An attacker with admin login can run code on the router. Talos has a crash trace showing PC control, but no public exploit. No vendor fix has been published.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["infrastructure","routers","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","other-models","wan-admin-disabled"],"how_to_check":"Log in to the router admin page and read the firmware version (Status/System). TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable; other builds are untested, so assume affected. Check whether the admin interface is reachable from WAN (remote management setting, or scan your public IP on ports 80/8080).","fix":"No fixed firmware published as of 2026-10-23 (unknown). Check totolink.net X2000R download page for newer firmware. Until then: turn off WAN/remote administration, restrict admin access to LAN, change the admin password to a strong unique one, and replace the router if exposed and unpatched.","status":"open","published_at":"2026-10-20T21:17:18+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:10+00:00","updated_at":"2026-10-23T23:14:43+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: stack overflow in device-delete handler allows code execution","impact":"high","summary":"A stack-based buffer overflow in the boa web server's formMapDelDevice macstr handler on the TOTOLINK X2000R router can be triggered by a crafted HTTP request. An attacker who gets through authentication can run arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","routers","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the router as an authenticated user.","analyst_note":"Check the vendor for a firmware fix for X2000R after version B20250421.1327 and confirm whether the admin web interface is exposed to WAN.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-models","auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000478,"input_tokens":2967,"output_tokens":363,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor for a firmware fix for X2000R after version B20250421.1327 and confirm whether the admin web interface is exposed to WAN.","search":"'-2026':15A,18A '-41223':16A,19A '/bin/map_del_device':47B '0.0':107C 'admin':58B 'allow':11A 'arbitrari':117C 'attack':56B,121C 'authent':125C 'b20250421.1327':108C 'base':87C 'boa':94C 'buffer':30B,88C 'code':12A,62B,118C 'control':73B 'craft':111C 'crash':69B 'cve':14A,17A 'delet':9A 'devic':8A 'device-delet':7A 'execut':13A,119C 'exist':91C 'exploit':77B 'fix':80B 'formmapdeldevic':39B,95C 'function':97C 'gh':105C 'handler':10A,40B 'host':26B 'http':112C,126C 'infrastructur':22B 'interfac':37B 'lead':115C 'login':59B 'macstr':43B,96C 'make':123C 'onto':52B 'overflow':5A,31B,89C 'paramet':45B 'pass':41B 'pc':72B 'post':44B 'public':76B 'publish':83B 'request':113C,127C 'router':3A,23B,65B 'run':61B 'self':25B 'self-host':24B 'show':71B 'special':110C 'stack':4A,29B,54B,86C 'stack-bas':85C 'strcpi':49B 'talo':66B 'totolink':1A,20A,27B,34B,103C 'totolink-x2000r-gh-v1':102C 'trace':70B 'trigger':129C 'v1':106C 'vendor':79B 'version':100C 'vulner':90C,131C 'web':36B 'x2000r':2A,21A,28B,35B,99C,104C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-41223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41223","severity":null,"published_at":"2026-10-20T21:17:18+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-41223:398","url":null,"severity":null,"published_at":"2026-10-23T23:14:43+00:00","modified_at":"2026-10-23T23:14:43+00:00","first_seen_at":"2026-10-23T23:14:43+00:00","fetched_at":"2026-10-23T23:14:43+00:00","note":"Read Talos TALOS-2026-2390 (primary): only B20250421.1327 confirmed vulnerable; vendor acknowledged 2026-06-25 but no fixed firmware or patch date in sources; no PoC or exploitation seen (not in KEV). Did not search social."}],"documents":[{"id":1854,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2390","title":"TALOS-2026-2390 Totolink X2000R formMapDelDevice macstr stack overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}