---
id: "CVE-2026-42025"
kind: "vulnerability"
aliases: ["CVE-2026-42025"]
title: "TOTOLINK X2000R router: HTTP request overflow lets authenticated attacker run code"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TOTOLINK X2000R firmware", "fixed": [], "affected": "TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327", "ecosystem": "vendor"}]
ecosystems: []
tags: ["embedded", "infrastructure", "iot", "routers", "totolink", "x2000r"]
not_affected_if: ["admin-interface-not-exposed", "auth-required", "other-firmware-version", "wan-admin-disabled"]
published_at: "2026-10-20T21:17:19+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T23:12:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42025", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:12:39+00:00"}]
---

# TOTOLINK X2000R router: HTTP request overflow lets authenticated attacker run code

Stack buffer overflow in the boa web server on the TOTOLINK X2000R. formIpv6Setup copies the dhcp_dns1 POST parameter to the stack with strcpy and no length check. An attacker who is logged in to the admin interface can send one crafted request and run code on the router. Talos shows full control of the program counter in its crash demo. The same bug exists in dhcp_dns2 (CVE-2026-42026). Talos filed about 30 similar CVEs against this firmware on 2026-10-20.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TOTOLINK X2000R firmware affected TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 fixed ?

## How to check

Log in to the router admin page and open the firmware or status page. If the version is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 you are affected. Then check whether the admin web interface answers from WAN, for example by scanning your public IP on ports 80 and 8080. Remote management should be off.

## Fix

No fixed firmware found. Talos lists no vendor patch or timeline. Check the TOTOLINK X2000R support page for newer firmware. Until then, turn off WAN/remote admin, restrict the admin UI to a trusted LAN, change the admin password to a strong unique one, and replace the router if no patch ships.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42025
- 2026-10-23T23:12:39+00:00 analyst — Primary source is Talos TALOS-2026-2396 (also covers sibling CVE-2026-42026, dhcp_dns2). Only build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is listed as affected. No vendor fix or advisory found. No public PoC or exploitation seen; KEV no, EPSS under 1%. Did not search social posts; the sources are all CVE-database rewrites.

## Documents

- [advisory] TALOS-2026-2396: Totolink X2000R boa formIpv6Setup dhcp_dns stack-based buffer overflows https://talosintelligence.com/vulnerability_reports/TALOS-2026-2396
- [describes] CVE Record CVE-2026-42025 https://www.cve.org/CVERecord?id=CVE-2026-42025

## From the sources

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_