noindex and left out of the sitemap until more data is confirmed.CVE-2026-42026 is a stack-based buffer overflow in the dhcp_dns1/dhcp_dns2 parameters of the formIpv6Setup handler on TOTOLINK X2000R router firmware that lets an authenticated attacker execute arbitrary code via a crafted HTTP request; Cisco Talos disclosed it in June 2026 and the vendor has not confirmed a fix, so this page stays noindex pending both a patch and NVD analysis.
Vulnerability summary
N/A
Not yet scored
0.5%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-20
Published
Vulnerability ID: CVE-2026-42026 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| TOTOLINK X2000R | — | Firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; no patched firmware version confirmed by the vendor as of 2026-10-28 |
What this means
CVE-2026-42026 is one of multiple stack-based buffer overflow vulnerabilities (CWE-121) that Cisco Talos researcher Lilith Wyatt found in the formIpv6Setup HTTP handler of TOTOLINK X2000R router firmware. Talos's advisory states the dhcp_dns1 and dhcp_dns2 parameters "are directly copied to the stack" without bounds validation, so "a specially crafted network request can lead to arbitrary code execution" (Cisco Talos Advisory TALOS-2026-2396).
NVD tracks CVE-2026-42026 with status "Deferred" as of 2026-10-28: its record carries a Secondary CVSS v3.1 score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) submitted by the discovering Cisco Talos CNA, but NVD has not itself analyzed or confirmed the score, so this page leaves cvss_score unset rather than presenting the submitted figure as NVD-confirmed (NVD). Note that the attack requires an authenticated session on the device (PR:H in the vector) — this is a post-authentication router-takeover bug, not a pre-auth remote one.
Talos's disclosure timeline shows the vendor was notified on 2026-06-16, acknowledged receipt on 2026-06-25, and received multiple Talos follow-ups between 2026-06-23 and 2026-09-15, but Talos's public report — released 2026-10-20 after the standard disclosure window elapsed — does not document any confirmed patched firmware version for the X2000R (Cisco Talos Advisory TALOS-2026-2396).
This CVE is not present in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-28, and FIRST scores the probability of exploitation at 0.005 (43.5th percentile), consistent with a vulnerability that requires authenticated access and has no confirmed in-the-wild use (CISA KEV, FIRST EPSS).
Because no vendor-confirmed fix exists for the affected firmware build, owners of TOTOLINK X2000R routers should restrict administrative access to trusted networks only, disable remote/WAN-side management, and change default credentials to reduce the chance an attacker obtains the authenticated session this flaw requires.
Evidence
- The dhcp_dns1 and dhcp_dns2 parameters of the formIpv6Setup handler on TOTOLINK X2000R are copied to the stack without bounds checking, allowing a crafted network request to achieve arbitrary code execution. — Cisco Talos Advisory TALOS-2026-2396
- NVD status is "Deferred" with only a Cisco Talos CNA Secondary CVSS v3.1 score of 9.1 (vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) on record as of 2026-10-28; no NVD-confirmed score. Affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327; exploitation requires an authenticated session (PR:H). — NVD
- Talos notified TOTOLINK on 2026-06-16, vendor acknowledged 2026-06-25, follow-ups sent through 2026-09-15; no confirmed patched firmware version documented as of the public report (2026-10-20). — Cisco Talos Advisory TALOS-2026-2396
- Not present in the CISA KEV catalog as of 2026-10-28. — CISA KEV
- EPSS score is 0.005 (43.5th percentile) as of 2026-10-28. — FIRST EPSS
