---
id: "CVE-2026-42024"
kind: "vulnerability"
aliases: ["CVE-2026-42024"]
title: "TOTOLINK X2000R router: crafted request overflows stack and runs code"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "X2000R", "fixed": [], "affected": "TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "routers", "self-hosted", "totolink", "x2000r"]
not_affected_if: ["auth-required", "no-ipv6-static-config", "other-router-models"]
published_at: "2026-10-20T21:17:19+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T23:12:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42024", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:12:38+00:00"}]
---

# TOTOLINK X2000R router: crafted request overflows stack and runs code

Stack buffer overflow in the boa web server's formIpv6Setup handler on the TOTOLINK X2000R. The static_gw parameter is copied to the stack with no bounds check. An attacker with admin login can send a crafted HTTP request and run code on the router. Found by Cisco Talos. No vendor fix is published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:X2000R affected TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 fixed ?

## How to check

Open the router admin page and read the firmware version. Build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed vulnerable; no other builds are listed either way, so treat all X2000R firmware as affected. Check whether the admin web interface answers from the WAN side (remote management setting), for example by testing the router's public IP from outside your network.

## Fix

unknown: no fixed firmware found. Check totolink.net X2000R product page for a newer build. Until then: turn off remote/WAN web management, change the admin password to a strong unique one, and restrict LAN access to the admin page.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42024
- 2026-10-23T23:12:38+00:00 analyst — Primary source Talos TALOS-2026-2395 (covers CVE-2026-42021..42024, same formIpv6Setup handler; 42024 is static_gw). Only build B20250421.1327 confirmed vulnerable; no vendor fix or advisory found, not in KEV, no public PoC or exploitation seen (Talos has crash traces only). WAN reachability of admin UI not stated by any source; social search not done.

## Documents

- [advisory] TALOS-2026-2395: Totolink X2000R boa formIpv6Setup stack-based buffer overflows https://talosintelligence.com/vulnerability_reports/TALOS-2026-2395
- [describes] CVE Record CVE-2026-42024 https://www.cve.org/CVERecord?id=CVE-2026-42024

## From the sources

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_