{"id":"CVE-2026-42024","kind":"vulnerability","aliases":["CVE-2026-42024"],"related":[],"title":"TOTOLINK X2000R router: crafted request overflows stack and runs code","description":"Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.","summary":"Stack buffer overflow in the boa web server's formIpv6Setup handler on the TOTOLINK X2000R. The static_gw parameter is copied to the stack with no bounds check. An attacker with admin login can send a crafted HTTP request and run code on the router. Found by Cisco Talos. No vendor fix is published.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","routers","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","no-ipv6-static-config","other-router-models"],"how_to_check":"Open the router admin page and read the firmware version. Build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable; no other builds are listed either way, so treat all X2000R firmware as affected. Check whether the admin web interface answers from the WAN side (remote management setting), for example by testing the router's public IP from outside your network.","fix":"unknown: no fixed firmware found. Check totolink.net X2000R product page for a newer build. Until then: turn off remote/WAN web management, change the admin password to a strong unique one, and restrict LAN access to the admin page.","status":"open","published_at":"2026-10-20T21:17:19+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:06+00:00","updated_at":"2026-10-23T23:12:38+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: crafted request overflows stack and runs code","impact":"high","summary":"The Totolink X2000R router's web setup handler for IPv6 static network settings has stack buffer overflows triggered through the static_gw parameter. An attacker who holds a valid login can send a crafted HTTP request to run arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","routers","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Code runs on the router with attacker-chosen commands after a crafted request.","analyst_note":"Find a vendor firmware fix or advisory for X2000R and confirm whether the admin web interface is reachable from WAN; the NVD entry gives no fixed version.","how_to_check":"Check the firmware version on the router's admin page against TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or earlier.\nunknown","needs_analyst":true,"not_affected_if":["other-router-models","no-ipv6-static-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000512,"input_tokens":2986,"output_tokens":426,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find a vendor firmware fix or advisory for X2000R and confirm whether the admin web interface is reachable from WAN; the NVD entry gives no fixed version.","search":"'-2026':12A,15A '-42024':13A,16A '0.0':103C 'admin':56B 'arbitrari':113C 'attack':54B,117C 'authent':121C 'b20250421.1327':104C 'base':82C 'boa':30B,89C 'bound':51B 'buffer':26B,83C 'check':52B 'cisco':72B 'code':10A,66B,114C 'concern':130C 'configur':93C 'copi':45B 'craft':4A,61B,107C 'cve':11A,14A 'execut':115C 'exist':86C 'fix':76B 'formipv6setup':34B,90C 'found':70B 'function':94C 'gh':101C 'gw':42B,133C 'handler':35B 'host':22B 'http':62B,108C,122C 'infrastructur':18B 'lead':111C 'login':57B 'make':119C 'multipl':79C 'network':92C 'overflow':6A,27B,84C 'paramet':43B,134C 'publish':78B 'request':5A,63B,109C,123C 'router':3A,19B,69B 'run':9A,65B 'self':21B 'self-host':20B 'send':59B 'server':32B 'special':106C 'stack':7A,25B,48B,81C 'stack-bas':80C 'static':41B,91C,132C 'talo':73B 'totolink':1A,23B,38B,96C,99C 'totolink-x2000r-gh-v1':98C 'trigger':125C 'v1':102C 'vendor':75B 'vulner':85C,127C,129C 'web':31B 'x2000r':2A,17A,24B,39B,97C,100C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42024","severity":null,"published_at":"2026-10-20T21:17:19+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42024:392","url":null,"severity":null,"published_at":"2026-10-23T23:12:38+00:00","modified_at":"2026-10-23T23:12:38+00:00","first_seen_at":"2026-10-23T23:12:38+00:00","fetched_at":"2026-10-23T23:12:38+00:00","note":"Primary source Talos TALOS-2026-2395 (covers CVE-2026-42021..42024, same formIpv6Setup handler; 42024 is static_gw). Only build B20250421.1327 confirmed vulnerable; no vendor fix or advisory found, not in KEV, no public PoC or exploitation seen (Talos has crash traces only). WAN reachability of admin UI not stated by any source; social search not done."}],"documents":[{"id":1840,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2395","title":"TALOS-2026-2395: Totolink X2000R boa formIpv6Setup stack-based buffer overflows","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1843,"url":"https://www.cve.org/CVERecord?id=CVE-2026-42024","title":"CVE Record CVE-2026-42024","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}