---
id: "CVE-2026-42023"
kind: "vulnerability"
aliases: ["CVE-2026-42023"]
title: "TOTOLINK X2000R router: stack overflow in IPv6 setup lets attackers run code"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TOTOLINK X2000R", "fixed": [], "affected": "TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327", "ecosystem": "firmware"}]
ecosystems: []
tags: ["boa", "firmware", "home-router", "infrastructure", "totolink", "x2000r"]
not_affected_if: ["auth-required", "other-firmware-versions", "wan-management-disabled"]
published_at: "2026-10-20T21:17:19+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T23:13:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42023", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:13:35+00:00"}]
---

# TOTOLINK X2000R router: stack overflow in IPv6 setup lets attackers run code

Stack buffer overflow in the static_ipv6 parameter of formIpv6Setup in the boa web server of the TOTOLINK X2000R, found by Cisco Talos. A logged-in admin can send one crafted POST and run code on the router. Only build B20250421.1327 is listed as tested. TOTOLINK has published no fix. Talos shows crash details but no working exploit.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:TOTOLINK X2000R affected TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 fixed ?

## How to check

Open the router admin UI and read the firmware version. TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable; other builds are untested. Also check whether the admin web UI is reachable from the WAN side (remote management setting), or from untrusted LAN/guest clients.

## Fix

No fixed firmware published as of 2026-10-23 (unknown). Check totolink.net X2000R product page for new firmware. Mitigate: turn off WAN remote management, restrict admin UI to trusted LAN hosts, use a strong unique admin password, replace the device if no patch appears.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42023
- 2026-10-23T23:13:35+00:00 analyst — Read Talos TALOS-2026-2395 (covers CVE-2026-42021..42024, same formIpv6Setup bug class, sibling signals) and CVE record. No vendor fix or advisory found; no PoC link or exploitation seen; X not searched (low yield).

## Documents

- [advisory] TALOS-2026-2395: Totolink X2000R boa formIpv6Setup stack-based buffer overflows https://talosintelligence.com/vulnerability_reports/TALOS-2026-2395
- [describes] CVE Record CVE-2026-42023 https://www.cve.org/CVERecord?id=CVE-2026-42023

## From the sources

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_