TOTOLINK X2000R vulnerabilities

A stack-based buffer overflow in the boa formTR069Config functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

An arbitrary file write vulnerability in the boa formUploadFile functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

A stack-based buffer overflow in the boa formUploadFile functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

An OS command injection vulnerability in the boa formWizard newPass functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

Multiple exploitable stack-based buffer overflows in the boa formFilter functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327), involving the vpnPassword parameter. A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

Multiple exploitable stack-based buffer overflows in the boa formFilter functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327), involving the vpnUser parameter. A specially crafted HTTP request can lead to arbitrary code execution; authentication is required.

A stack-based buffer overflow exists in the boa formIpv6Setup dhcp_dns functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the dhcp_dns2 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup dhcp_dns functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the dhcp_dns1 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_gw parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_ipv6 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_dns2 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup static network configuration functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the static_dns1 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup pppoe functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the pppoe_dns2 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formIpv6Setup pppoe functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) in the pppoe_dns1 parameter. A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formMapDelDevice macstr functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

A stack-based buffer overflow exists in the boa formParentControl url functionality of TOTOLINK X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. The vulnerability can be triggered by an authenticated HTTP request.

An OS command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

An OS command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

An OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

An unsigned firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerability.

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

An OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

A heap-based buffer overflow exists in the boa formUpload() functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can trigger this vulnerability with an authenticated HTTP request.

An OS command injection vulnerability exists in the batchupg functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can trigger this vulnerability with an authenticated HTTP request.

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can trigger this vulnerability with an authenticated HTTP request.

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can trigger this vulnerability with an authenticated HTTP request.

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can trigger this vulnerability with an authenticated HTTP request.

A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0 in the Administrative Interface component, where manipulation of the file /etc/shadow.sample results in use of default credentials. Attacking locally is a requirement and the attack is highly complex. The exploit has been released to the public and may be exploited.