CVE-2023-7208 is a buffer overflow in the formTmultiAP function of the web server in Totolink X2000R V2 firmware 2.0.0-B20230727.10434. It scores 8.0 (High). The vendor did not respond to the reporter, and no fixed firmware is named, so limit access to the router's admin interface.
What's affected
Affected: Totolink X2000R V2 running firmware 2.0.0-B20230727.10434. The vulnerable function is formTmultiAP in /bin/boa, the router's web server binary.
Fixed: none is named. The description notes that the vendor was contacted early and did not respond in any way. Check Totolink's download page for newer firmware before drawing conclusions, since I did not find a vendor advisory.
The vector is AV:A, meaning the attacker must be on the same network segment, and PR:L, meaning a low privilege login is needed. That lowers the risk compared with an internet reachable bug, but home and office networks often share Wi-Fi with guests. The weaknesses are CWE-120 and CWE-787. KEV is false.
A second record, CVE-2023-7222, covers the same function in the older X2000R firmware from December 2022.
How to check if you're exposed
Log in to the router admin page and read the firmware version on the status or system page. If it reads 2.0.0-B20230727.10434 on an X2000R V2, you are on the version named in the record.
Also confirm that remote management is off, and that the admin page is not reachable from the internet. From outside your network, try to open the router's public address on the admin port. If it answers, close it.
What to do now
- Check Totolink's support site for newer firmware for the X2000R V2 and apply it if one exists.
- Turn off remote administration and make sure the admin page is reachable only from a wired, trusted machine.
- Do not let guests or untrusted devices share the same network segment as the router's admin interface. Use a guest network.
- Change the admin password to something unique.
- If no fix ever appears, plan to replace the device. The vendor's silence is a risk of its own.
Why it matters
A buffer overflow occurs when code writes more data into a memory buffer than it was sized for. On routers, the web server is often written in C and runs with full rights, so a memory bug can mean control of the device. CWE-787 is the out-of-bounds write that results.
The pattern in this group of Totolink records is similar: input handlers that copy request values without checking the length. The vendor's lack of a response matters, because without a patch, the only controls left are network ones.
Quick check
Is a patch available for CVE-2023-7208?
None is named in the record, and I found no vendor advisory. Check the manufacturer's firmware page.
Can it be exploited from the internet?
The vector is adjacent network, so the attacker needs to be on the local network segment. Exposing the admin interface to the internet would change that.
Sources
Last reviewed: 19 October 2026.
