Vulnerability · Published Oct 20, 2026 · Assigned by talos

CVE-2026-42025

Critical 9.1

In plain English

A critical-severity stack buffer overflow in Totolink from totolink. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 56.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.

Affected products (as reported)

Vendor	Product	Versions
totolink	Totolink	TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2396