EUVD-2026-43736
GHSA-4p43-rxhv-xw72
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 14, 2026
Stack-based buffer overflow in the Totolink NR1800X router (firmware 9.1.0u.6279_B20210910) lets remote attackers corrupt memory by supplying an oversized HTTP Host header to the Form_Logout handler at /formLogout.htm, served by the embedded lighttpd web interface. Because the flaw is reachable over the network without authentication and publicly available exploit code exists, it is a strong candidate for opportunistic exploitation despite not yet appearing in CISA KEV. Successful exploitation can crash the device or, given the CWE-121 stack overwrite, potentially achieve code execution on the router.
Earlier versions of this analysis (1)
Remote unauthenticated stack-based buffer overflow in the TOTOLINK NR1800X router (firmware 9.1.0u.6279_B20210910) allows attackers to corrupt memory by supplying an oversized HTTP Host header to the Form_Logout handler of /formLogout.htm in the embedded lighttpd web service. Publicly available exploit code exists, and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote triggering with no authentication or user interaction, threatening full compromise of the device. No public evidence of active in-the-wild exploitation (not in CISA KEV) was found at time of analysis, though a POC is disclosed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Nr1800X gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Unauthenticated network-reachable overflow via HTTP Host header with no user interaction (AV:N/AC:L/PR:N/UI:N); memory-corruption code execution yields full C/I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of the component lighttpd. This manipulation of the argument Host causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
Totolik NR1800X routers running firmware 9.1.0u.6279_B20210910 contain a critical stack-overflow vulnerability allowing unauthenticated remote attackers to crash devices or potentially execute code. Publicly available exploit code exists, creating immediate risk of infrastructure compromise and network disruption. No vendor patch is available, requiring urgent defensive actions to prevent opportunistic exploitation.
Within 24 hours, inventory all Totolik NR1800X routers on your network and confirm firmware version 9.1.0u.6279_B20210910 or earlier; immediately restrict network access to the administrative web interface (/formLogout.htm) using firewall rules blocking all unauthenticated external connections. Within 7 days, deploy intrusion detection or prevention signatures to block HTTP requests with oversized Host headers (>1KB), and disable remote administration features if not operationally essential. Within 30 days, monitor Totolik vendor advisories for patch releases, evaluate firmware upgrades or alternative hardware solutions, and implement network segmentation to isolate router management access and contain any potential device compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Firewall rules restricting network access to router administrative interfaces, blocking all unauthenticated external connections; (2) Host-header validation and request-size limits on upstream proxies or WAF systems; (3) Disable remote administration protocols if operationally feasible; (4) Network segmentation isolating router management interfaces from general-access networks; (5) Continuous monitoring for exploitation attempts targeting /formLogout.htm with anomalous HTTP requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 enables remote code execution through the
Command injection in Totolink NR1800X firmware 9.1.0u.6279_B20210910 allows authenticated remote attackers to execute ar
Command injection in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 allows network-accessible attackers with low-privil
Exploit-DB