CVE-2026-28763

Summary

A stack-based buffer overflow in the formMapDelDevice hostname functionality of the X2000R router's web interface allows authenticated attackers to execute arbitrary code by sending a specially crafted HTTP request that overflows a stack buffer.

Exploitability

Exploitation requires valid authentication and a single HTTP request; no user interaction is needed, but the attacker must be authenticated first.

Blast radius

Successful exploitation could lead to full device compromise including remote code execution, data theft, and potential pivot to internal networks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later; if no fixed version is available, disable the affected formMapDelDevice endpoint and restrict web interface access to trusted IPs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.