CVE-2026-42024

Summary

Stack-based buffer overflow in the formIpv6Setup function of Totolink X2000R firmware allows authenticated remote attackers to overwrite the stack and achieve arbitrary code execution via a malicious static_gw parameter in an HTTP request.

Exploitability

Exploitation requires valid authentication credentials and sending a specially crafted HTTP request to the affected endpoint; no public exploit exists yet, but the high CVSS score indicates low complexity once access is obtained.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption on the vulnerable router.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later, as this is the only version explicitly referenced in the description and likely contains the fix for the buffer overflow.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.