CVE-2026-42020

Summary

Stack-based buffer overflows in the pppoe_dns2 parameter of the formIpv6Setup function allow authenticated remote code execution on Totolink X2000R routers due to unsafe handling of user-supplied input.

Exploitability

Exploitation requires valid authenticated HTTP access and sending a specially crafted request with an oversized pppoe_dns2 value; high privilege (PR:H) is required, but no user interaction.

Blast radius

Successful exploitation could lead to full compromise of the router—including loss of confidentiality, integrity, and availability—potentially enabling persistent backdoor access or network-wide lateral movement.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the only version explicitly referenced in the description that addresses the vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.