Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R… (CVE-2026-42020)

The Totolink X2000R device running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains multiple stack-based buffer overflow vulnerabilities in the boa web server's formIpv6Setup pppoe functionality. An attacker with authentication privileges can send a specially crafted HTTP request manipulating the pppoe_dns2 parameter to trigger these vulnerabilities, leading to arbitrary code execution. The vulnerabilities are classified under CWE-121 (stack-based buffer overflow) and have a CVSS 3.1 score of 9.1, indicating critical impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the affected device, potentially compromising the device's confidentiality, integrity, and availability. This could lead to full control over the device and disruption of network services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the device's management interface to trusted users only and monitor for suspicious authenticated HTTP requests targeting the pppoe_dns2 parameter.