CVE-2026-7546
Published: 01 May 2026
Summary
CVE-2026-7546 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink NR1800X (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7546 is a stack-based buffer overflow vulnerability affecting the find_host_ip function in the lighttpd component of the Totolink NR1800X router firmware version 9.1.0u.6279_B20210910. The issue arises from improper handling of the Host argument, allowing remote attackers to trigger the overflow. It is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidential data, modification of system integrity, and denial of service through availability disruption. The exploit has been publicly disclosed and is available for use.
Advisories and related resources, including VulDB entries (https://vuldb.com/vuln/360357, https://vuldb.com/submit/804404, https://vuldb.com/vuln/360357/cti) and a GitHub proof-of-concept (https://github.com/newym/cve/blob/main/totolinknr1800x.md), provide further technical details. The Totolink vendor site (https://www.totolink.net/) should be consulted for any firmware updates or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26473
Vulnerability details
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. The impacted element is the function find_host_ip of the component lighttpd. Such manipulation of the argument Host leads to stack-based buffer overflow. The attack can be executed remotely. The exploit…
more
has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated stack-based buffer overflow in the lighttpd web server component of a router's public-facing interface, directly enabling exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the buffer overflow vulnerability by requiring identification, reporting, and correction of the specific flaw in the lighttpd find_host_ip function via firmware updates.
Requires validation of the Host header argument to prevent stack-based buffer overflows from improper input handling in the lighttpd component.
Implements memory protections such as stack canaries and non-executable stacks to block exploitation of the stack-based buffer overflow vulnerability.