Zero Radar
← feed
CriticalVulnerabilityCVE-2026-42024updated 25 Oct 2026, 15:22 UTC

TOTOLINK X2000R router: remote code execution via IPv6 setup page

A flaw in the router's web settings page lets someone who can log in send a specially crafted request that takes over the router. A taken-over router can be used to spy on or attack the network behind it.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker logs inNeeds valid authenticated access to the web UI
  2. 2Crafted HTTP requestOversized static_gw value sent to IPv6 setup
  3. 3Buffer overflowStack memory overwritten in boa handler
  4. 4Code executionAttacker runs commands on the router
  5. ResultAttacker controls the router

What happened

Stack-based buffer overflows in the boa formIpv6Setup static network configuration handler of TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, triggered via the static_gw parameter in an authenticated HTTP request, allow arbitrary code execution.

Why it is dangerous: An attacker who can authenticate to the router's web interface can run code on the device, potentially gaining full control of the home or small-office network it protects.

Are you affected?

You are affected if you run TOTOLINK X2000R with firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and the web management interface is reachable by attackers.

TOTOLINK X2000R, firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327

What to do

  1. Check the router's firmware version and look for a vendor update addressing this issue
  2. Restrict access to the router's admin page: disable remote management and do not expose it to the internet
  3. Change the admin password to a strong, unique one until a fix is installed

Timeline

  1. 20 Oct 2026, 21:17 UTC
    Publicly disclosed
  2. 20 Oct 2026, 21:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:22 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-42024 · GHSA-mg96-rwrg-39c4
CVSS
9.1 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 21:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

TOTOLINK X2000R router: remote code execution via IPv6 setup page · Zero Radar