CVE-2026-42026

Summary

Stack-based buffer overflow in the formIpv6Setup dhcp_dns functionality of X2000R router allows authenticated remote attackers to execute arbitrary code via a specially crafted HTTP request containing an overly long dhcp_dns2 parameter.

Exploitability

Exploitation requires valid authenticated access to the device's web interface; no public exploit exists, but the vulnerability is straightforward to trigger once authenticated.

Blast radius

Successful exploitation grants full system compromise (RCE) with potential for complete device takeover, lateral movement within the local network, and persistent backdoor installation.

Detection

Look for HTTP POST requests to /formIpv6Setup with an unusually long dhcp_dns2 parameter value (>256 bytes) in web server logs; authentication success followed by such a request may indicate exploitation attempt.

Prioritized remediation

Upgrade to TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 or later; if no fixed version is available, disable the formIpv6Setup endpoint or restrict access to it via ACLs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.