Which versions of Nr1800X are affected by CVE-2026-15701?

Totolik NR1800X routers running firmware 9.1.0u.6279_B20210910 contain a critical stack-overflow vulnerability allowing unauthenticated remote attackers to crash devices or potentially execute code.

Is there a public PoC exploit available for CVE-2026-15701?

Yes, a public proof-of-concept exploit is available for CVE-2026-15701. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-15701?

Within 24 hours, inventory all Totolik NR1800X routers on your network and confirm firmware version 9.1.0u.6279_B20210910 or earlier; immediately restrict network access to the administrative web interface (/formLogout.htm) using firewall rules blocking all unauthenticated external connections. Within 7 days, deploy intrusion detection or prevention signatures to block HTTP requests with oversized Host headers (>1KB), and disable remote administration features if not operationally essential. Within 30 days, monitor Totolik vendor advisories for patch releases, evaluate firmware upgrades or alternative hardware solutions, and implement network segmentation to isolate router management access and contain any potential device compromise.

Nr1800X CVE-2026-15701

Q: What is the CVSS score of CVE-2026-15701?

CVE-2026-15701 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-43736 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 VulDB

GHSA-4p43-rxhv-xw72

Buffer Overflow Stack Overflow Nr1800X

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable overflow via HTTP Host header with no user interaction (AV:N/AC:L/PR:N/UI:N); memory-corruption code execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 17:22 vuln.today

cvss_changed

Severity Changed

Jul 14, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

Jul 14, 2026 - 17:22 NVD

9.3 (CRITICAL) 8.9 (HIGH)

Analysis Generated

Jul 14, 2026 - 17:02 vuln.today

CVE Published

Jul 14, 2026 - 16:30 cve.org

CRITICAL 9.3

DescriptionCVE.org

A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of the component lighttpd. This manipulation of the argument Host causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Stack-based buffer overflow in the Totolink NR1800X router (firmware 9.1.0u.6279_B20210910) lets remote attackers corrupt memory by supplying an oversized HTTP Host header to the Form_Logout handler at /formLogout.htm, served by the embedded lighttpd web interface. Because the flaw is reachable over the network without authentication and publicly available exploit code exists, it is a strong candidate for opportunistic exploitation despite not yet appearing in CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all Totolik NR1800X routers on your network and confirm firmware version 9.1.0u.6279_B20210910 or earlier; immediately restrict network access to the administrative web interface (/formLogout.htm) using firewall rules blocking all unauthenticated external connections. …

Threat intelligence, references, and detailed analysis are available after sign-in.