CVE Intelligence
Analysis AI-assisted

CVE-2026-7546: Totolink NR1800X stack-based buffer overflow in find_host_ip

A stack-based buffer overflow has been reported in the find_host_ip function of the lighttpd component in Totolink NR1800X 9.1.0u.6279_B20210910, triggered by manipulation of the Host argument. According to the CNA record, the attack can be carried out remotely and a public exploit has been disclosed. The sources consulted show no confirmed exploitation in the wild, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7546 describes a stack-based buffer overflow classified as CWE-119 in the find_host_ip function of the lighttpd component used by Totolink NR1800X 9.1.0u.6279_B20210910. The record was published on 2026-05-01 by the CNA VulDB, and its status is recorded as Deferred. The original VulDB entry is the main source for the technical description.

Impact

  • A memory corruption flaw on the stack can, in general, cause crashes or affect program execution. The record does not state what outcome is achievable on this device.
  • The CNA assigns a CVSS 3.1 base score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack, no privileges, no user interaction and high impact on confidentiality, integrity and availability.
  • The CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.

Affected products and versions

  • The only product version identified in the record is 9.1.0u.6279_B20210910 of the Totolink NR1800X.
  • The structured affected-product and affected-version fields are empty, so the full range of vulnerable versions is unknown.
  • The vendor website is listed as a reference at totolink.net.

Exploitation status

  • The record states that the exploit has been disclosed publicly and may be used.
  • The CVE is not listed in CISA KEV in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.0102 with a percentile of 0.62467, as recorded.

Remediation and mitigation

  • No fixed version or vendor patch is identified in the record. Check the vendor website for firmware updates for this model and apply any available update.
  • Do not expose the device administration or web interface to untrusted networks. Restrict access to trusted management segments.
  • If no update exists, plan replacement or retirement of the device, since the record gives no evidence of a fix.

Detection guidance

  • Review logs of the device web service and any upstream proxy for unusually long or malformed Host header values.
  • Alert on unexpected reboots, crashes or service restarts of the router.
  • Inventory devices of this model and version so that they can be prioritized for review.

Limitations of the available information

  • The record lacks a version range, a fixed version and a vendor advisory.
  • The public write-up referenced in the record was not verified in detail for this analysis.
  • The EPSS date recorded (2026-10-13) is later than the publication date and should be verified against the source.
  • Whether the flaw leads to code execution or only to a crash is not established by the record.

Frequently asked questions

Is CVE-2026-7546 being actively exploited?

The sources consulted show no confirmed exploitation in the wild, and the CVE is not listed in CISA KEV. The record does state that a public exploit has been disclosed, which is a different condition from confirmed exploitation.

Is there a fixed version for this vulnerability?

The record lists no fixed version or patch. This is unknown rather than proof that no fix exists, so check the vendor website for firmware updates for the affected model.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.