How do I check whether I am affected by CVE-2026-42025?

Log in to the router admin page and open the firmware or status page. If the version is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 you are affected. Then check whether the admin web interface answers from WAN, for example by scanning your public IP on ports 80 and 8080. Remote management should be off.

What is the fix for CVE-2026-42025?

No fixed firmware found. Talos lists no vendor patch or timeline. Check the TOTOLINK X2000R support page for newer firmware. Until then, turn off WAN/remote admin, restrict the admin UI to a trusted LAN, change the admin password to a strong unique one, and replace the router if no patch ships.

Who is not affected by CVE-2026-42025?

Not affected if: admin-interface-not-exposed, auth-required, other-firmware-version, wan-admin-disabled.

Live › vulnerability › CVE-2026-42025

Go to dashboard

critical9.1Infrastructure

TOTOLINK X2000R router: HTTP request overflow lets authenticated attacker run code

Stack buffer overflow in the boa web server on the TOTOLINK X2000R. formIpv6Setup copies the dhcp_dns1 POST parameter to the stack with strcpy and no length check. An attacker who is logged in to the admin interface can send one crafted request and run code on the router. Talos shows full control of the program counter in its crash demo. The same bug exists in dhcp_dns2 (CVE-2026-42026). Talos filed about 30 similar CVEs against this firmware on 2026-10-20.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.1

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker runs code on the router and takes over the device.
CVSS said: 9.1. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-42025

Go to dashboard

critical9.1Infrastructure

TOTOLINK X2000R router: HTTP request overflow lets authenticated attacker run code

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.1

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker runs code on the router and takes over the device.
CVSS said: 9.1. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

TOTOLINK X2000R router: HTTP request overflow lets authenticated attacker run code

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

TOTOLINK X2000R router: HTTP request overflow lets authenticated attacker run code

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources