{"id":"CVE-2026-42026","kind":"vulnerability","aliases":["CVE-2026-42026"],"related":[],"title":"TOTOLINK X2000R router: overflow in IPv6 setup lets attackers run code","description":"Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.","summary":"The boa web server's formIpv6Setup handler on the TOTOLINK X2000R router copies the dhcp_dns2 parameter into a fixed-size stack buffer without checking its length. An attacker with a logged-in session can send a crafted HTTP request to run arbitrary code on the router.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"X2000R","fixed":[],"affected":"TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","iot","router","self-hosted","totolink","x2000r"],"not_affected_if":["auth-required","other-firmware-versions","wan-admin-disabled"],"how_to_check":"Log in to the router admin page and read the firmware version; TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is the only build confirmed vulnerable (other builds untested, not confirmed safe). Check whether the admin web interface (boa, /boafrm/*) is reachable from WAN or from untrusted LAN/guest segments.","fix":"No fixed firmware published as of 2026-10-23 (unknown; check totolink.net X2000R product page https://www.totolink.net/home/menu/newstpl/menu_newstpl/products/id/242.html). Mitigate: disable remote/WAN web administration, restrict admin UI to a trusted LAN, change default admin password, keep untrusted users off the LAN.","status":"open","published_at":"2026-10-20T21:17:19+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:05+00:00","updated_at":"2026-10-23T23:12:29+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:39:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TOTOLINK X2000R router: overflow in IPv6 setup lets attackers run code","impact":"high","summary":"The boa web server's formIpv6Setup handler on the TOTOLINK X2000R router copies the dhcp_dns2 parameter into a fixed-size stack buffer without checking its length. An attacker with a logged-in session can send a crafted HTTP request to run arbitrary code on the router.","category":"infrastructure","who_cares":["totolink","x2000r","router","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs code on the router as root and controls the network.","analyst_note":"Check the NVD entry and vendor site for a firmware fix and whether the admin web interface is reachable from WAN; sources give no version fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-firmware-versions","auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000487,"input_tokens":3009,"output_tokens":373,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and vendor site for a firmware fix and whether the admin web interface is reachable from WAN; sources give no version fix.","search":"'-2026':13A,16A '-42026':14A,17A '0.0':101C 'arbitrari':71B,111C 'attack':9A,56B,115C 'authent':119C 'b20250421.1327':102C 'base':80C 'boa':28B,87C 'buffer':50B,81C 'check':52B 'code':11A,72B,112C 'concern':128C 'copi':39B 'craft':66B,105C 'cve':12A,15A 'dhcp':41B,89C,130C 'dns':90C 'dns2':42B,131C 'execut':113C 'exist':84C 'exploit':77C 'fix':47B 'fixed-s':46B 'formipv6setup':32B,88C 'function':91C 'gh':99C 'handler':33B 'host':24B 'http':67B,106C,120C 'infrastructur':19B 'iot':20B 'ipv6':6A 'lead':109C 'length':54B 'let':8A 'log':60B 'logged-in':59B 'make':117C 'multipl':76C 'overflow':4A,82C 'paramet':43B,132C 'request':68B,107C,121C 'router':3A,21B,38B,75B 'run':10A,70B 'self':23B 'self-host':22B 'send':64B 'server':30B 'session':62B 'setup':7A 'size':48B 'special':104C 'stack':49B,79C 'stack-bas':78C 'totolink':1A,25B,36B,97C 'totolink-x2000r-gh-v1':96C 'trigger':123C 'v1':100C 'version':94C 'vulner':83C,125C,127C 'web':29B 'without':51B 'x2000r':2A,18A,26B,37B,93C,98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42026","severity":null,"published_at":"2026-10-20T21:17:19+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42026:390","url":null,"severity":null,"published_at":"2026-10-23T23:12:29+00:00","modified_at":"2026-10-23T23:12:29+00:00","first_seen_at":"2026-10-23T23:12:29+00:00","fetched_at":"2026-10-23T23:12:29+00:00","note":"Read Talos TALOS-2026-2396 (primary, shared with sibling CVE-2026-42025 dhcp_dns1): unbounded strcpy of dhcp_dns2 in /boafrm/formIpv6Setup; needs login, wan_enable set and OriginType=2. No vendor fix or patched firmware published in any source; no PoC/exploitation found; no X post search done (obscure)."}],"documents":[{"id":1837,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2396","title":"TALOS-2026-2396: Totolink X2000R boa formIpv6Setup dhcp_dns stack-based buffer overflows","kind":"advisory","source":"analyst","text":"Talos report for CVE-2026-42025 (dhcp_dns1) and CVE-2026-42026 (dhcp_dns2). Affected: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. Authenticated POST to /boafrm/formIpv6Setup with wan_enable nonzero and OriginType=2; dhcp_dns1 is strcpy'd to the stack unchecked. Crash demo shows PC control (0x42424242). No fix or vendor timeline in report.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}