---
id: "CVE-2026-42021"
kind: "vulnerability"
aliases: ["CVE-2026-42021"]
title: "TOTOLINK X2000R router: IPv6 setup overflow lets attackers run code"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TOTOLINK X2000R firmware", "fixed": [], "affected": "TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only build confirmed)", "ecosystem": "firmware"}]
ecosystems: []
tags: ["infrastructure", "router", "self-hosted", "totolink", "x2000r"]
not_affected_if: ["auth-required", "other-router-models"]
published_at: "2026-10-20T21:17:19+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T23:13:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42021", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:13:50+00:00"}]
---

# TOTOLINK X2000R router: IPv6 setup overflow lets attackers run code

The web management interface (boa) on the TOTOLINK X2000R router has stack buffer overflows in its IPv6 static network configuration handler, triggered through the static_dns1 parameter. An attacker who holds a valid login can send a crafted HTTP request to run arbitrary code on the router.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:TOTOLINK X2000R firmware affected TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only build confirmed) fixed ?

## How to check

In the router admin UI (System status / firmware info) read the firmware version; build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is the one confirmed vulnerable. Other builds are untested, not known safe. Also check whether the admin web interface (boa, port 80) is reachable from WAN.

## Fix

No fixed firmware published that I could find (unknown; check https://www.totolink.net/home/menu/newstpl/menu_newstpl/products/id/242.html). Mitigation: disable remote/WAN web administration, restrict admin UI to a trusted LAN, change default admin password, since exploit needs a valid login.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42021
- 2026-10-23T23:13:50+00:00 analyst — Talos TALOS-2026-2395 (CNA) confirms only build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 tested vulnerable; static_dns1 is the CVE-2026-42021 variable (siblings 42022-42024: static_dns2, static_ipv6, ...). No fixed firmware found; vendor status not seen in the part of the page I read; no PoC, no exploitation seen. Not searched X.

## Documents

- [advisory] TALOS-2026-2395: Totolink X2000R boa formIpv6Setup stack-based buffer overflows https://talosintelligence.com/vulnerability_reports/TALOS-2026-2395

## From the sources

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_