CVE-2026-42021

Summary

Stack-based buffer overflow in the formIpv6Setup function of Totolink X2000R firmware allows authenticated remote code execution via a malicious static_dns1 parameter in an HTTP request.

Exploitability

Exploitation requires valid authentication and sending a specially crafted HTTP request to the static network configuration endpoint; no public exploit exists yet, but the vulnerability is straightforward for an attacker with credentials.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) on the device, potentially enabling lateral movement within the local network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the only fixed version referenced in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.