{"id":"CVE-2026-42021","kind":"vulnerability","aliases":["CVE-2026-42021"],"related":[],"title":"TOTOLINK X2000R router: IPv6 setup overflow lets attackers run code","description":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.","summary":"The web management interface (boa) on the TOTOLINK X2000R router has stack buffer overflows in its IPv6 static network configuration handler, triggered through the static_dns1 parameter. An attacker who holds a valid login can send a crafted HTTP request to run arbitrary code on the router.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R firmware","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only build confirmed)","ecosystem":"firmware"}],"ecosystems":[],"tags":["infrastructure","router","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","other-router-models"],"how_to_check":"In the router admin UI (System status / firmware info) read the firmware version; build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is the one confirmed vulnerable. Other builds are untested, not known safe. Also check whether the admin web interface (boa, port 80) is reachable from WAN.","fix":"No fixed firmware published that I could find (unknown; check https://www.totolink.net/home/menu/newstpl/menu_newstpl/products/id/242.html). Mitigation: disable remote/WAN web administration, restrict admin UI to a trusted LAN, change default admin password, since exploit needs a valid login.","status":"open","published_at":"2026-10-20T21:17:19+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:08+00:00","updated_at":"2026-10-23T23:13:50+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:39:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: IPv6 setup overflow lets attackers run code","impact":"high","summary":"The web management interface (boa) on the TOTOLINK X2000R router has stack buffer overflows in its IPv6 static network configuration handler, triggered through the static_dns1 parameter. An attacker who holds a valid login can send a crafted HTTP request to run arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","router","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs code on the router as root and controls network traffic","analyst_note":"Confirm the firmware build B20250421.1327 is the affected range and find whether TOTOLINK has published a fixed firmware version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","other-router-models"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000482,"input_tokens":2987,"output_tokens":367,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the firmware build B20250421.1327 is the affected range and find whether TOTOLINK has published a fixed firmware version.","search":"'-2026':12A,15A '-42021':13A,16A '0.0':98C 'arbitrari':69B,108C 'attack':8A,55B,112C 'authent':116C 'b20250421.1327':99C 'base':77C 'boa':31B,84C 'buffer':39B,78C 'code':10A,70B,109C 'concern':125C 'configur':46B,88C 'craft':64B,102C 'cve':11A,14A 'dns1':52B,128C 'execut':110C 'exist':81C 'firmware':19A 'formipv6setup':85C 'function':89C 'gh':96C 'handler':47B 'hold':57B 'host':24B 'http':65B,103C,117C 'infrastructur':20B 'interfac':30B 'ipv6':4A,43B 'lead':106C 'let':7A 'login':60B 'make':114C 'manag':29B 'multipl':74C 'network':45B,87C 'overflow':6A,40B,79C 'paramet':53B,129C 'request':66B,104C,118C 'router':3A,21B,36B,73B 'run':9A,68B 'self':23B 'self-host':22B 'send':62B 'setup':5A 'special':101C 'stack':38B,76C 'stack-bas':75C 'static':44B,51B,86C,127C 'totolink':1A,17A,25B,34B,91C,94C 'totolink-x2000r-gh-v1':93C 'trigger':48B,120C 'v1':97C 'valid':59B 'vulner':80C,122C,124C 'web':28B 'x2000r':2A,18A,26B,35B,92C,95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42021","severity":null,"published_at":"2026-10-20T21:17:19+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42021:395","url":null,"severity":null,"published_at":"2026-10-23T23:13:50+00:00","modified_at":"2026-10-23T23:13:50+00:00","first_seen_at":"2026-10-23T23:13:50+00:00","fetched_at":"2026-10-23T23:13:50+00:00","note":"Talos TALOS-2026-2395 (CNA) confirms only build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 tested vulnerable; static_dns1 is the CVE-2026-42021 variable (siblings 42022-42024: static_dns2, static_ipv6, ...). No fixed firmware found; vendor status not seen in the part of the page I read; no PoC, no exploitation seen. Not searched X."}],"documents":[{"id":1840,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2395","title":"TALOS-2026-2395: Totolink X2000R boa formIpv6Setup stack-based buffer overflows","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}