CVE-2026-42019

Summary

Stack-based buffer overflows in the Totolink X2000R's pppoe_dns1 parameter during formIpv6Setup processing allow authenticated remote code execution via malicious HTTP requests.

Exploitability

Exploitation requires valid authentication and a crafted HTTP request targeting the vulnerable pppoe_dns1 parameter; no public exploit exists, but the high CVSS score indicates low technical barriers for a determined attacker with credentials.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption on the affected router.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the only fixed version explicitly referenced in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.