CVE-2026-42023

Summary

The Totolink X2000R router's static IPv6 configuration endpoint (formIpv6Setup) contains stack-based buffer overflows when processing the static_ipv6 parameter, allowing authenticated attackers to overwrite the stack and potentially execute arbitrary code.

Exploitability

Exploitation requires valid administrative credentials and a single authenticated HTTP request; no user interaction is needed.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, and availability) on the vulnerable router, enabling complete network takeover and potential pivot to internal devices.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the only fixed version explicitly referenced in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.