Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Totolink X2000R router static DNS setting can be exploited

CVE-2026-42021 · published 15 days ago
Summary

The X2000R router’s web interface for configuring static IPv6 settings contains a flaw in how it handles the static_dns1 field. An attacker who can log in and send a crafted request could cause the router to run unwanted code, potentially taking control of the device. Apply the latest firmware update from Totolink or restrict access to the router’s management interface.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
totolink totolink TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
Original advisory text
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A special...
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published20 Oct 2026
Updated4 Nov 2026
First seen20 Oct 2026
Sources
CVE-2026-42021 · NVD
CVE-2026-42021 · MITRE
Track software like this
Free during beta