{"id":"CVE-2026-42022","kind":"vulnerability","aliases":["CVE-2026-42022"],"related":[],"title":"TOTOLINK X2000R router: stack overflow in IPv6 setup lets attacker run code","description":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.","summary":"Stack-based buffer overflow (CWE-121) in the boa web server's formIpv6Setup handler on the TOTOLINK X2000R. The static_dns2 POST parameter is copied to the stack with no length check. An authenticated attacker on the admin interface can send one HTTP request and run code on the router. Talos reproduced it on firmware B20250421.1327 and shows a controlled PC. Talos rates it 9.1 because it needs a login, but the router's default or weak credentials make that bar low.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R firmware","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only build tested)","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","iot","routers","self-hosted","totolink","x2000r"],"not_affected_if":["admin-not-exposed","auth-required","no-admin-credentials-for-attacker","no-web-admin-exposure"],"how_to_check":"Open the router admin page, go to System/Status and read the firmware version. TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable. Other builds were not tested, so treat them as unknown. To check WAN exposure, turn off remote management in the admin settings, or scan your public IP for the web admin port (80, or 8080 if you changed it) from outside your network.","fix":"No fixed firmware has been published as far as the sources show (unknown). Mitigation: disable WAN/remote web management, restrict the admin UI to a trusted LAN, change the default admin password, and turn off IPv6 static configuration if you do not use it. Watch totolink.net/X2000R downloads for a new build.","status":"open","published_at":"2026-10-20T21:17:19+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:07+00:00","updated_at":"2026-10-23T23:13:50+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: stack overflow in IPv6 setup lets attacker run code","impact":"high","summary":"The web management interface (boa formIpv6Setup handler) of the TOTOLINK X2000R router has stack-based buffer overflows triggered through the static_dns2 parameter. An attacker who holds a valid login can send a crafted HTTP request to execute arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","routers","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"code runs on the router with full device control","analyst_note":"Find the vendor advisory or a firmware release that fixes X2000R firmware B20250421.1327 and check whether the web admin interface is reachable from the internet.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","no-web-admin-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000486,"input_tokens":2991,"output_tokens":374,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or a firmware release that fixes X2000R firmware B20250421.1327 and check whether the web admin interface is reachable from the internet.","search":"'-121':36B '-2026':14A,17A '-42022':15A,18A '0.0':137C '9.1':95B 'admin':68B 'arbitrari':147C 'attack':10A,65B,151C 'authent':64B,155C 'b20250421.1327':86B,138C 'bar':111B 'base':32B,116C 'boa':39B,123C 'buffer':33B,117C 'check':62B 'code':12A,77B,148C 'concern':164C 'configur':127C 'control':90B 'copi':55B 'craft':141C 'credenti':108B 'cve':13A,16A 'cwe':35B 'default':105B 'dns2':51B,167C 'execut':149C 'exist':120C 'firmwar':85B 'firmware':21A 'formipv6setup':43B,124C 'function':128C 'gh':135C 'handler':44B 'host':27B 'http':73B,142C,156C 'infrastructur':22B 'interfac':69B 'iot':23B 'ipv6':7A 'lead':145C 'length':61B 'let':9A 'login':100B 'low':112B 'make':109B,153C 'multipl':113C 'need':98B 'network':126C 'one':72B 'overflow':5A,34B,118C 'paramet':53B,168C 'pc':91B 'post':52B 'rate':93B 'reproduc':82B 'request':74B,143C,157C 'router':3A,24B,80B,103B 'run':11A,76B 'self':26B 'self-host':25B 'send':71B 'server':41B 'setup':8A 'show':88B 'special':140C 'stack':4A,31B,58B,115C 'stack-bas':30B,114C 'static':50B,125C,166C 'talo':81B,92B 'totolink':1A,19A,28B,47B,130C,133C 'totolink-x2000r-gh-v1':132C 'trigger':159C 'v1':136C 'vulner':119C,161C,163C 'weak':107B 'web':40B 'x2000r':2A,20A,29B,48B,131C,134C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42022","severity":null,"published_at":"2026-10-20T21:17:19+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42022:394","url":null,"severity":null,"published_at":"2026-10-23T23:13:50+00:00","modified_at":"2026-10-23T23:13:50+00:00","first_seen_at":"2026-10-23T23:13:50+00:00","fetched_at":"2026-10-23T23:13:50+00:00","note":"Cisco Talos TALOS-2026-2395 (Oct 20 2026) is the primary source; covers siblings CVE-2026-42021..42024. No vendor fix, firmware or timeline found; no X posts. Talos rates 9.1 (PR:H, authenticated); no exploitation or public PoC seen beyond Talos crash traces."}],"documents":[{"id":1840,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2395","title":"TALOS-2026-2395: Totolink X2000R boa formIpv6Setup stack-based buffer overflows","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1850,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42022","title":"NVD: CVE-2026-42022","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}