---
id: "CVE-2026-42019"
kind: "vulnerability"
aliases: ["CVE-2026-42019"]
title: "Totolink X2000R router: stack overflow in IPv6 PPPoE setup lets attackers run code"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "X2000R", "fixed": [], "affected": "TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327", "ecosystem": "firmware"}]
ecosystems: []
tags: ["infrastructure", "routers", "self-hosted", "totolink", "x2000r"]
not_affected_if: ["auth-required", "other-models", "remote-management-disabled"]
published_at: "2026-10-20T21:17:18+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T23:14:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42019", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:14:44+00:00"}]
---

# Totolink X2000R router: stack overflow in IPv6 PPPoE setup lets attackers run code

The web management interface (boa, formIpv6Setup) of the Totolink X2000R router has stack-based buffer overflows in its PPPoE settings, triggered through the pppoe_dns1 parameter. An attacker who is logged in to the admin interface can send a crafted HTTP request to run code on the router.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:X2000R affected TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 fixed ?

## How to check

Open the router admin page, Status/Firmware: version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is affected. Also check whether the web UI answers from the WAN side.

## Fix

No fixed firmware published as of 2026-10-23. Mitigate: turn off WAN/remote management of the admin UI, restrict it to a trusted LAN, change default admin credentials, and check totolink.tw/totolink.net X2000R support pages for new firmware.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42019
- 2026-10-23T23:14:44+00:00 analyst — No vendor advisory or fixed firmware found: TOTOLINK security bulletins list nothing for X2000R; only NVD and a RedTeam Monitor rewrite (no patch confirmed). No X posts, no public PoC found, no exploitation reported. Part of a batch of sibling X2000R boa CVEs.

## Documents

- [describes] RedTeam Monitor: Totolink X2000R PPPoE flaws https://redteammonitor.com/c/vulnerabilities/totolink-x2000r-firmware-v1-0-0-b20250421-1327/
- [mentions] TOTOLINK security bulletins (no X2000R entry) https://www.totolink.net/support/security-bulletins

## From the sources

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns1 parameter.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_