CVE-2026-42022

Summary

The Totolink X2000R router's formIpv6Setup function contains stack-based buffer overflows when processing the static_dns2 parameter in authenticated HTTP requests, allowing an authenticated attacker to overwrite stack memory and potentially execute arbitrary code.

Exploitability

Exploitation requires valid authentication and sending a specially crafted HTTP request targeting the vulnerable static_dns2 parameter; no public exploits are known, but the high CVSS score suggests feasibility for a skilled attacker.

Blast radius

Successful exploitation could lead to full compromise of the router—including remote code execution, data exfiltration, and service disruption—potentially affecting all devices relying on it for network access.

Detection

Monitor HTTP POST requests to /formIpv6Setup for unusually long values in the static_dns2 parameter (e.g., >64 characters) and correlate with authenticated sessions; no reliable host-based artefacts are described.

Prioritized remediation

Upgrade to firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later if a patched build exists; otherwise, disable the static IPv6 configuration feature or restrict access to the formIpv6Setup endpoint to trusted internal networks only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.