CVE-2026-28763

A stack-based buffer overflow vulnerability exists in the boa web server's formMapDelDevice hostname functionality in the X2000R router (version: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The flaw is caused by an unchecked strcpy operation that copies an HTTP POST hostname parameter into a fixe...

EUVD-2026-105350

A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger...

EUVD-2026-105349

A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger th...

CVE-2026-40627

A critical OS command injection vulnerability exists in the boa formWsc functionality of the Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The root cause is located in the formWsc() function, where the targetAPSsid HTTP POST parameter is processed. While the escape_q...

CVE-2026-40615

A stack-based buffer overflow vulnerability exists in the boa web server's formParentControl function of the TOTOLINK X2000R (specifically version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The flaw is triggered when an authenticated attacker sends a specially crafted HTTP POST request containin...

CVE-2026-33568

The Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to OS command injection via the boa web server's formMapDelDevice functionality. The vulnerability occurs because the macstr parameter from an HTTP POST request is passed unsanitized to the /bin/map_del_d...

EUVD-2026-105348

A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

CVE-2026-41222

The Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to a stack-based buffer overflow in the boa binary's formParentControl function. An authenticated attacker can trigger this by sending a specially crafted HTTP POST request to the /boafrm/formParentContro...

EUVD-2026-105346

A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigg...

EUVD-2026-105347

A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

CVE-2026-42020

The Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to multiple stack-based buffer overflow vulnerabilities in the boa web server. Specifically, the pppoe_dns2 HTTP POST parameter is copied to the stack without any checks or restrictions, which can lead to...

CVE-2026-42019

The Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to multiple stack-based buffer overflow flaws in the boa formIpv6Setup pppoe functionality. Specifically, the pppoe_dns1 HTTP POST parameter is copied to the stack without any checks or restrictions, whic...

EUVD-2026-105345

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger...

EUVD-2026-105344

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger...

EUVD-2026-105339

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcpdns functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP...

CVE-2026-42026

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcpdns functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP...

CVE-2026-42026

The X2000R router (specifically version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) contains multiple exploitable stack-based buffer overflow vulnerabilities within the boa formIpv6Setup dhcp_dns functionality. The issue specifically concerns the dhcp_dns2 parameter. An attacker with high privileg...

CVE-2026-42025

The Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to multiple stack-based buffer overflow vulnerabilities in the boa binary's formIpv6Setup functionality. The flaw exists because the dhcp_dns1 and dhcp_dns2 HTTP POST parameters are copied directly to the...

CVE-2026-42024

The Totolink X2000R (firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is affected by multiple stack-based buffer overflow vulnerabilities within the boa formIpv6Setup static network configuration functionality. The flaw specifically concerns the static_gw parameter. An authenticated at...

EUVD-2026-105338

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcpdns functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP...