CVE-2026-7546
Published: 01 May 2026
Description
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. The impacted element is the function find_host_ip of the component lighttpd. Such manipulation of the argument Host leads to stack-based buffer overflow. The attack can be executed remotely. The exploit…
more
has been disclosed publicly and may be used.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the buffer overflow vulnerability by requiring identification, reporting, and correction of the specific flaw in the lighttpd find_host_ip function via firmware updates.
Requires validation of the Host header argument to prevent stack-based buffer overflows from improper input handling in the lighttpd component.
Implements memory protections such as stack canaries and non-executable stacks to block exploitation of the stack-based buffer overflow vulnerability.
Security SummaryAI
CVE-2026-7546 is a stack-based buffer overflow vulnerability affecting the find_host_ip function in the lighttpd component of the Totolink NR1800X router firmware version 9.1.0u.6279_B20210910. The issue arises from improper handling of the Host argument, allowing remote attackers to trigger the overflow. It is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidential data, modification of system integrity, and denial of service through availability disruption. The exploit has been publicly disclosed and is available for use.
Advisories and related resources, including VulDB entries (https://vuldb.com/vuln/360357, https://vuldb.com/submit/804404, https://vuldb.com/vuln/360357/cti) and a GitHub proof-of-concept (https://github.com/newym/cve/blob/main/totolinknr1800x.md), provide further technical details. The Totolink vendor site (https://www.totolink.net/) should be consulted for any firmware updates or mitigation guidance.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated stack-based buffer overflow in the lighttpd web server component of a router's public-facing interface, directly enabling exploitation of a public-facing application.