TALOS-2026-2394
CVE-2026-42019,CVE-2026-42020
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formWsc peerRptPin functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327)
X2000R - https://www.totolink.net/home/menu/newstpl/menu_newstpl/products/id/242.html
9.1 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-121 - Stack-based Buffer Overflow
The Totolink X2000R is a popular budget gigabit home router primarly found in eastern markets. Supporting IPV6, WPA3, mesh capabilities among other features, the Totolink X2000R is a solid choice for the price point.
A stack-based buffer overflow exists in the pppoe_dns1 HTTP POST parameter which is directly copied to the stack at [4] without any checks or restrictions whatsoever. As such, this easily leads to arbitrary code execution.
Breakpoint 1, 0x00457e38 in ?? ()
[o.o]> !ls
***********************************************************************************
***********************************************************************************
v0[H] : 0x004afd00 | s3 : 0x00000000
v1 : 0x00000000 | s4 : 0x00000000
a0[S] : 0x7f96d498 | s5[H] : 0x004afc88
a1 : 0x00000001 | s6[H] : 0x004afc60
a2[L] : 0x76fbe2d0 | s7 : 0x0000000d
a3 : 0x00000001 | t8[X] : 0x0048c0dc
t0 : 0x76fc4628 | t9[L] : 0x7748f8bc
t1 : 0x76fc4628 | k0 : 0x00000000
t2[H] : 0x004afcc8 | k1 : 0x00000000
t3 : 0xfffffffc | gp[L] : 0x774ab020
t4 : 0x00000020 | sp[S] : 0x7f96d440
t5 : 0x00000001 | ra[X] : 0x00457e34
t6 : 0x000000b0 | status : 0x0000f413
t7[H] : 0x00490000 | badvaddr[H] : 0x004980f0
s0[H] : 0x004d9810 | pc[X] : 0x00457e38
s1 : 0x00480000 | fcsr : 0x00000000
s2 : 0x00000000 | restart : 0x00000000
***********************************************************************************
0x457e2c: jal 0x40f600
0x457e30: move a0,s0
0x457e34: addiu a0,sp,88
=> 0x457e38: jal 0x47bf60
0x457e3c: move a1,v0
0x457e40: lui a1,0x48
0x457e44: addiu a2,s1,-32576
0x457e48: b 0x457dbc
0x457e4c: addiu a1,a1,-30284
***********************************************************************************
#0 0x00457e38 in (0x400000 0x47c000 0x7c000 0x0 r-xp /bin/boa)(+0x57e38)
***********************************************************************************
[>_>]> x/1s $v0
0x4afd00: 'A' <repeats 200 times>...
[<_<]> c
Continuing.
[Detaching after fork from child process 8243]
Program received signal SIGBUS, Bus error.
0x42424242 in ?? ()
[x.x]> !ls
***********************************************************************************
***********************************************************************************
v0 : 0x00000000 | s3 : 0x41414141
v1 : 0x00000001 | s4 : 0x41414141
a0 : 0x00000002 | s5 : 0x41414141
a1[S] : 0x7f96d3f4 | s6 : 0x41414141
a2[S] : 0x7f96d3d8 | s7 : 0x0000000d
a3 : 0x00000000 | t8 : 0x00000000
t0 : 0x00000000 | t9[L] : 0x76f44830
t1 : 0x86c65a28 | k0 : 0x00000000
t2 : 0xfffffffc | k1 : 0x00000000
t3 : 0x86c65a29 | gp[L] : 0x76fc6400
t4 : 0x00000000 | sp[S] : 0x7f96d590
t5 : 0x00000000 | ra : 0x42424242
t6 : 0x00000000 | status : 0x0000f413
t7 : 0x00000000 | badvaddr : 0x42424242
s0 : 0x41414141 | pc : 0x42424242
s1 : 0x41414141 | fcsr : 0x00000000
s2 : 0x41414141 | restart : 0x00000000
***********************************************************************************
Invalid $pc @ 0x42424242
#0 0x42424242 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
***********************************************************************************
A stack-based buffer overflow exists in the pppoe_dns2 HTTP POST parameter which is directly copied to the stack at [5] without any checks or restrictions whatsoever. As such, this easily leads to arbitrary code execution.
[^.^]> b *0x457dc8
Breakpoint 1 at 0x457dc8
[-.-]> c
Continuing.
[Detaching after fork from child process 8559]
[Detaching after fork from child process 8578]
[Detaching after fork from child process 8580]
[Detaching after fork from child process 8581]
Breakpoint 1, 0x00457dc8 in ?? ()
[o.o]> !ls
***********************************************************************************
***********************************************************************************
v0[H] : 0x004afea0 | s3 : 0x00000000
v1 : 0x00000000 | s4 : 0x00000000
a0[S] : 0x7fa22248 | s5[H] : 0x004afdf0
a1 : 0x00000001 | s6[H] : 0x004afdc8
a2[L] : 0x771ec2d0 | s7 : 0x0000000d
a3 : 0x00000001 | t8[X] : 0x0048c0dc
t0 : 0x771f2628 | t9[L] : 0x776bd8bc
t1 : 0x771f2628 | k0 : 0x00000000
t2[H] : 0x004afe50 | k1 : 0x00000000
t3 : 0xfffffffc | gp[L] : 0x776d9020
t4 : 0x00000020 | sp[S] : 0x7fa22230
t5 : 0x00000001 | ra[X] : 0x00457dc4
t6 : 0x00000060 | status : 0x0000f413
t7[H] : 0x00490000 | badvaddr : 0x770fb139
s0[H] : 0x004ba850 | pc[X] : 0x00457dc8
s1 : 0x00480000 | fcsr : 0x00000000
s2 : 0x00000000 | restart : 0x00000000
***********************************************************************************
0x457dbc: jal 0x40f600
0x457dc0: move a0,s0
0x457dc4: addiu a0,sp,24
=> 0x457dc8: jal 0x47bf60
0x457dcc: move a1,v0
0x457dd0: addiu a1,sp,88
0x457dd4: jal 0x47b8d0
0x457dd8: li a0,10088
***********************************************************************************
#0 0x00457dc8 in (0x400000 0x47c000 0x7c000 0x0 r-xp /bin/boa)(+0x57dc8)
***********************************************************************************
[>_>]> x/1s $v0
0x4afea0: 'A' <repeats 200 times>...
[<_<]> c
Continuing.
[Detaching after fork from child process 8598]
Program received signal SIGBUS, Bus error.
0x42424242 in ?? ()
[?.?] uhhhh...? Unhandled signal, gg. SIGBUS
[x.x]> !ls
***********************************************************************************
***********************************************************************************
v0 : 0x00000000 | s3 : 0x41414141
v1 : 0x00000001 | s4 : 0x41414141
a0 : 0x00000002 | s5 : 0x41414141
a1[S] : 0x7fa221e4 | s6 : 0x41414141
a2[S] : 0x7fa221c8 | s7 : 0x0000000d
a3 : 0x00000000 | t8 : 0x41414141
t0 : 0x00000000 | t9[L] : 0x77172830
t1 : 0x0d7989c8 | k0 : 0x00000000
t2 : 0xfffffffc | k1 : 0x00000000
t3 : 0x000eaf82 | gp[L] : 0x771f4400
t4 : 0x00000000 | sp[S] : 0x7fa22380
t5 : 0x00000000 | ra : 0x42424242
t6 : 0x00000000 | status : 0x0000f413
t7 : 0x41414141 | badvaddr : 0x42424242
s0 : 0x41414141 | pc : 0x42424242
s1 : 0x41414141 | fcsr : 0x00000000
s2 : 0x41414141 | restart : 0x00000000
***********************************************************************************
Invalid $pc @ 0x42424242
#0 0x42424242 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
***********************************************************************************
***********************************************************************************
2026-06-16 - vulndev@cisco.com - Initial Vendor Notification
2026-06-23 - vulndiscovery@external.cisco.com - Follow-up sent
2026-06-25 - fae_hardware@zioncom.net - Vendor Acknowledged
2026-06-25 - vulndiscovery@external.cisco.com - Resent all notifications
2026-07-16 - vulndiscovery@external.cisco.com - Follow-up sent
2026-09-15 - vulndiscovery@external.cisco.com - Follow-up sent
Lilith Wyatt of Cisco Talos