CVE-2026-42023

The Totolink X2000R (specifically version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is susceptible to multiple stack-based buffer overflow vulnerabilities within the boa formIpv6Setup static network configuration functionality. The root cause is linked to the handling of the static_ipv6 paramete...

EUVD-2026-105338

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcpdns functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP...

EUVD-2026-105341

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated...

EUVD-2026-105336

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to...

CVE-2026-9660

The X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to multiple exploitable stack-based buffer overflow vulnerabilities within the boa formFilter functionality. A specially crafted authenticated HTTP request targeting the vpnPassword parameter can trigger these flaws, pot...

EUVD-2026-105337

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to...

CVE-2026-9659

The Totolink X2000R router (version: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to multiple stack-based buffer overflow issues within the boa formFilter functionality. The vulnerability occurs when an authenticated user sends a specially crafted HTTP POST request to the /boafrm/form...

CVE-2026-9869

The Totolink X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to a stack-based buffer overflow in the boa binary's formTR069Config() functionality. An authenticated attacker can trigger this by sending a specially crafted HTTP POST request to the /boafrm/formTR069Config pa...

CVE-2026-9817

A stack-based buffer overflow vulnerability exists in the boa web server's formUploadFile() function on the TOTOLINK X2000R (specifically version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The flaw occurs because the application copies a filename from multi-part form data into a stack-based buff...

EUVD-2026-105332

A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

EUVD-2026-105334

A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

CVE-2026-10132

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of the X2000R router (version: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The flaw is triggered when a specially crafted authenticated HTTP request is sent to the /boafrm/formIpQos page. Specifically, if th...

CVE-2026-10133

A stack-based buffer overflow exists in the batchupg functionality of the TOTOLINK X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The vulnerability is triggered when an authenticated user sends a specially crafted HTTP POST request to the /boafrm/formBuploadSetting page. The p...

EUVD-2026-105329

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

EUVD-2026-105330

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

CVE-2026-10136

The Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to a heap-based buffer overflow in the boa binary's formUpload() functionality. The root cause is located in the get_filename_from_buf() function, where the length passed to strncpy is derived from the in...

CVE-2026-10135

A CRITICAL OS command injection vulnerability exists in the batchupg functionality of the Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The root cause stems from a lack of sanitization on the filename parameter across a multi-step data flow: first, it is received via...

EUVD-2026-105327

A heap-based buffer overflow vulnerability exists in the boa formUpload functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

EUVD-2026-105328

A OS command injection vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2026-10137

A stack-based buffer overflow exists in the boa formUpload() functionality of the Totolink X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The vulnerability occurs because the formUpload function fails to perform length checks when using strcpy to copy the value of the devicemac%d HTT...