---
id: "CVE-2026-42022"
kind: "vulnerability"
aliases: ["CVE-2026-42022"]
title: "TOTOLINK X2000R router: stack overflow in IPv6 setup lets attacker run code"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TOTOLINK X2000R firmware", "fixed": [], "affected": "TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only build tested)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "iot", "routers", "self-hosted", "totolink", "x2000r"]
not_affected_if: ["admin-not-exposed", "auth-required", "no-admin-credentials-for-attacker", "no-web-admin-exposure"]
published_at: "2026-10-20T21:17:19+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T23:13:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42022", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:13:50+00:00"}]
---

# TOTOLINK X2000R router: stack overflow in IPv6 setup lets attacker run code

Stack-based buffer overflow (CWE-121) in the boa web server's formIpv6Setup handler on the TOTOLINK X2000R. The static_dns2 POST parameter is copied to the stack with no length check. An authenticated attacker on the admin interface can send one HTTP request and run code on the router. Talos reproduced it on firmware B20250421.1327 and shows a controlled PC. Talos rates it 9.1 because it needs a login, but the router's default or weak credentials make that bar low.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TOTOLINK X2000R firmware affected TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (only build tested) fixed ?

## How to check

Open the router admin page, go to System/Status and read the firmware version. TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable. Other builds were not tested, so treat them as unknown. To check WAN exposure, turn off remote management in the admin settings, or scan your public IP for the web admin port (80, or 8080 if you changed it) from outside your network.

## Fix

No fixed firmware has been published as far as the sources show (unknown). Mitigation: disable WAN/remote web management, restrict the admin UI to a trusted LAN, change the default admin password, and turn off IPv6 static configuration if you do not use it. Watch totolink.net/X2000R downloads for a new build.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42022
- 2026-10-23T23:13:50+00:00 analyst — Cisco Talos TALOS-2026-2395 (Oct 20 2026) is the primary source; covers siblings CVE-2026-42021..42024. No vendor fix, firmware or timeline found; no X posts. Talos rates 9.1 (PR:H, authenticated); no exploitation or public PoC seen beyond Talos crash traces.

## Documents

- [advisory] TALOS-2026-2395: Totolink X2000R boa formIpv6Setup stack-based buffer overflows https://talosintelligence.com/vulnerability_reports/TALOS-2026-2395
- [describes] NVD: CVE-2026-42022 https://nvd.nist.gov/vuln/detail/CVE-2026-42022

## From the sources

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_