CVE-2026-40615

Summary

A stack-based buffer overflow in the formParentControl deviceName functionality of X2000R allows authenticated attackers to overwrite the stack and execute arbitrary code via a crafted HTTP request.

Exploitability

Exploitation requires valid authentication and sending a specially crafted HTTP request to the vulnerable endpoint; no public exploit exists yet, but the high CVSS score indicates low complexity once access is gained.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) on the device, potentially enabling lateral movement within the local network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the only fixed version explicitly named in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.