{"id":"CVE-2026-42023","kind":"vulnerability","aliases":["CVE-2026-42023"],"related":[],"title":"TOTOLINK X2000R router: stack overflow in IPv6 setup lets attackers run code","description":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.","summary":"Stack buffer overflow in the static_ipv6 parameter of formIpv6Setup in the boa web server of the TOTOLINK X2000R, found by Cisco Talos. A logged-in admin can send one crafted POST and run code on the router. Only build B20250421.1327 is listed as tested. TOTOLINK has published no fix. Talos shows crash details but no working exploit.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"firmware"}],"ecosystems":[],"tags":["boa","firmware","home-router","infrastructure","totolink","x2000r"],"not_affected_if":["auth-required","other-firmware-versions","wan-management-disabled"],"how_to_check":"Open the router admin UI and read the firmware version. TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable; other builds are untested. Also check whether the admin web UI is reachable from the WAN side (remote management setting), or from untrusted LAN/guest clients.","fix":"No fixed firmware published as of 2026-10-23 (unknown). Check totolink.net X2000R product page for new firmware. Mitigate: turn off WAN remote management, restrict admin UI to trusted LAN hosts, use a strong unique admin password, replace the device if no patch appears.","status":"open","published_at":"2026-10-20T21:17:19+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:06+00:00","updated_at":"2026-10-23T23:13:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: stack overflow in IPv6 setup lets attackers run code","impact":"high","summary":"The web management interface (boa) of the TOTOLINK X2000R router has stack-based buffer overflows in its static IPv6 configuration handler, triggered by the static_ipv6 parameter. An attacker who holds a login to the router's web interface can send a crafted HTTP request and run arbitrary code on the device.","category":"infrastructure","who_cares":["totolink","x2000r","home-router"],"confidence":0.6,"needs_auth":"yes","worst_case":"Arbitrary code runs on the router, giving the attacker control of the device","analyst_note":"Find the vendor's fixed firmware version and whether the web admin interface is exposed to WAN; check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-42023.","how_to_check":"Check the router firmware version against TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 in the admin UI or the device label; the sources do not give a command.","needs_analyst":true,"not_affected_if":["auth-required","other-firmware-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00053,"input_tokens":2990,"output_tokens":461,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor's fixed firmware version and whether the web admin interface is exposed to WAN; check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-42023.","search":"'-2026':14A,17A '-42023':15A,18A '0.0':112C 'admin':56B 'arbitrari':122C 'attack':10A,126C 'authent':130C 'b20250421.1327':70B,113C 'base':91C 'boa':21B,41B,98C 'buffer':30B,92C 'build':69B 'cisco':50B 'code':12A,64B,123C 'concern':139C 'configur':102C 'craft':60B,116C 'crash':82B 'cve':13A,16A 'detail':83B 'execut':124C 'exist':95C 'exploit':87B 'firmwar':22B 'fix':79B 'formipv6setup':38B,99C 'found':48B 'function':103C 'gh':110C 'home':24B 'home-rout':23B 'http':117C,131C 'infrastructur':26B 'ipv6':7A,35B,142C 'lead':120C 'let':9A 'list':72B 'log':54B 'logged-in':53B 'make':128C 'multipl':88C 'network':101C 'one':59B 'overflow':5A,31B,93C 'paramet':36B,143C 'post':61B 'publish':77B 'request':118C,132C 'router':3A,25B,67B 'run':11A,63B 'send':58B 'server':43B 'setup':8A 'show':81B 'special':115C 'stack':4A,29B,90C 'stack-bas':89C 'static':34B,100C,141C 'talo':51B,80B 'test':74B 'totolink':1A,19A,27B,46B,75B,105C,108C 'totolink-x2000r-gh-v1':107C 'trigger':134C 'v1':111C 'vulner':94C,136C,138C 'web':42B 'work':86B 'x2000r':2A,20A,28B,47B,106C,109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42023","severity":null,"published_at":"2026-10-20T21:17:19+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42023:393","url":null,"severity":null,"published_at":"2026-10-23T23:13:35+00:00","modified_at":"2026-10-23T23:13:35+00:00","first_seen_at":"2026-10-23T23:13:35+00:00","fetched_at":"2026-10-23T23:13:35+00:00","note":"Read Talos TALOS-2026-2395 (covers CVE-2026-42021..42024, same formIpv6Setup bug class, sibling signals) and CVE record. No vendor fix or advisory found; no PoC link or exploitation seen; X not searched (low yield)."}],"documents":[{"id":1840,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2395","title":"TALOS-2026-2395: Totolink X2000R boa formIpv6Setup stack-based buffer overflows","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1847,"url":"https://www.cve.org/CVERecord?id=CVE-2026-42023","title":"CVE Record CVE-2026-42023","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}