{"id":"CVE-2026-42025","kind":"vulnerability","aliases":["CVE-2026-42025"],"related":[],"title":"TOTOLINK X2000R router: HTTP request overflow lets authenticated attacker run code","description":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.","summary":"Stack buffer overflow in the boa web server on the TOTOLINK X2000R. formIpv6Setup copies the dhcp_dns1 POST parameter to the stack with strcpy and no length check. An attacker who is logged in to the admin interface can send one crafted request and run code on the router. Talos shows full control of the program counter in its crash demo. The same bug exists in dhcp_dns2 (CVE-2026-42026). Talos filed about 30 similar CVEs against this firmware on 2026-10-20.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TOTOLINK X2000R firmware","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["embedded","infrastructure","iot","routers","totolink","x2000r"],"not_affected_if":["admin-interface-not-exposed","auth-required","other-firmware-version","wan-admin-disabled"],"how_to_check":"Log in to the router admin page and open the firmware or status page. If the version is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 you are affected. Then check whether the admin web interface answers from WAN, for example by scanning your public IP on ports 80 and 8080. Remote management should be off.","fix":"No fixed firmware found. Talos lists no vendor patch or timeline. Check the TOTOLINK X2000R support page for newer firmware. Until then, turn off WAN/remote admin, restrict the admin UI to a trusted LAN, change the admin password to a strong unique one, and replace the router if no patch ships.","status":"open","published_at":"2026-10-20T21:17:19+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:05+00:00","updated_at":"2026-10-23T23:12:39+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: HTTP request overflow lets authenticated attacker run code","impact":"high","summary":"The boa web server's formIpv6Setup handler on the TOTOLINK X2000R router has stack buffer overflows in the dhcp_dns1 parameter. An authenticated attacker can send a crafted HTTP request and execute arbitrary code on the device.","category":"infrastructure","who_cares":["totolink","x2000r","routers","embedded"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs code on the router and takes over the device.","analyst_note":"Check the vendor advisory or NVD for a patched firmware build and whether the web admin interface is reachable from WAN; NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-42025 gave no fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-firmware-version","admin-interface-not-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.0005,"input_tokens":3008,"output_tokens":399,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the vendor advisory or NVD for a patched firmware build and whether the web admin interface is reachable from WAN; NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-42025 gave no fix.","search":"'-10':109B '-20':110B '-2026':13A,16A,96B '-42025':14A,17A '-42026':97B '0.0':136C '2026':108B '30':101B 'admin':63B 'arbitrari':146C 'attack':9A,56B,150C 'authent':8A,154C 'b20250421.1327':137C 'base':115C 'boa':32B,122C 'buffer':28B,116C 'bug':90B 'check':54B 'code':11A,72B,147C 'concern':163C 'control':79B 'copi':40B 'counter':83B 'craft':68B,140C 'crash':86B 'cve':12A,15A,95B 'cves':103B 'demo':87B 'dhcp':42B,93B,124C,165C 'dns':125C 'dns1':43B,166C 'dns2':94B 'embed':21B 'execut':148C 'exist':91B,119C 'exploit':112C 'file':99B 'firmwar':106B 'firmware':20A 'formipv6setup':39B,123C 'full':78B 'function':126C 'gh':134C 'http':4A,141C,155C 'infrastructur':22B 'interfac':64B 'iot':23B 'lead':144C 'length':53B 'let':7A 'log':59B 'make':152C 'multipl':111C 'one':67B 'overflow':6A,29B,117C 'paramet':45B,167C 'post':44B 'program':82B 'request':5A,69B,142C,156C 'router':3A,24B,75B 'run':10A,71B 'send':66B 'server':34B 'show':77B 'similar':102B 'special':139C 'stack':27B,48B,114C 'stack-bas':113C 'strcpi':50B 'talo':76B,98B 'totolink':1A,18A,25B,37B,132C 'totolink-x2000r-gh-v1':131C 'trigger':158C 'v1':135C 'version':129C 'vulner':118C,160C,162C 'web':33B 'x2000r':2A,19A,26B,38B,128C,133C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42025","severity":null,"published_at":"2026-10-20T21:17:19+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42025:391","url":null,"severity":null,"published_at":"2026-10-23T23:12:39+00:00","modified_at":"2026-10-23T23:12:39+00:00","first_seen_at":"2026-10-23T23:12:39+00:00","fetched_at":"2026-10-23T23:12:39+00:00","note":"Primary source is Talos TALOS-2026-2396 (also covers sibling CVE-2026-42026, dhcp_dns2). Only build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is listed as affected. No vendor fix or advisory found. No public PoC or exploitation seen; KEV no, EPSS under 1%. Did not search social posts; the sources are all CVE-database rewrites."}],"documents":[{"id":1837,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2396","title":"TALOS-2026-2396: Totolink X2000R boa formIpv6Setup dhcp_dns stack-based buffer overflows","kind":"advisory","source":"analyst","text":"Talos report for CVE-2026-42025 (dhcp_dns1) and CVE-2026-42026 (dhcp_dns2). Affected: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Authenticated POST to /boafrm/formIpv6Setup with wan_enable nonzero and OriginType=2; dhcp_dns1 is strcpy'd to the stack unchecked. Crash demo shows PC control (0x42424242). No fix or vendor timeline in report.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1844,"url":"https://www.cve.org/CVERecord?id=CVE-2026-42025","title":"CVE Record CVE-2026-42025","kind":"other","source":"analyst","text":"CNA Cisco Talos. CVSS 3.1 9.1 AV:N/AC:L/PR:H/UI:N/S:C. CWE-121. Affected only TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; no fixed version listed. Credit Lilith Wyatt, Cisco Talos.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}