Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R… (CVE-2026-42021)

The Totolink X2000R device running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains multiple stack-based buffer overflow vulnerabilities in the boa web server's formIpv6Setup static network configuration functionality. Specifically, the static_dns1 parameter in an authenticated HTTP request can be exploited to cause a buffer overflow, leading to arbitrary code execution. The vulnerabilities are identified as CWE-121 (stack-based buffer overflow). No patch or remediation information is provided in the source data.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the affected device, potentially leading to full compromise including confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector with low attack complexity, requiring high privileges but no user interaction, and results in complete system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the device's management interface to trusted users only and monitor for suspicious authenticated HTTP requests targeting the static_dns1 parameter. No official fix or workaround is currently documented.