Which versions of Nr1800X are affected by EUVD-2026-43736?

Totolik NR1800X routers running firmware 9.1.0u.6279_B20210910 contain a critical stack-overflow vulnerability allowing unauthenticated remote attackers to crash devices or potentially execute code.

Is there a public PoC exploit available for EUVD-2026-43736?

Yes, a public proof-of-concept exploit is available for EUVD-2026-43736. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate EUVD-2026-43736?

Within 24 hours, inventory all Totolik NR1800X routers on your network and confirm firmware version 9.1.0u.6279_B20210910 or earlier; immediately restrict network access to the administrative web interface (/formLogout.htm) using firewall rules blocking all unauthenticated external connections. Within 7 days, deploy intrusion detection or prevention signatures to block HTTP requests with oversized Host headers (>1KB), and disable remote administration features if not operationally essential. Within 30 days, monitor Totolik vendor advisories for patch releases, evaluate firmware upgrades or alternative hardware solutions, and implement network segmentation to isolate router management access and contain any potential device compromise.

Nr1800X EUVD-2026-43736

Q: What is the CVSS score of EUVD-2026-43736?

EUVD-2026-43736 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

| CVE-2026-15701 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 VulDB

GHSA-4p43-rxhv-xw72

Buffer Overflow Stack Overflow Nr1800X TOTOLINK

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable overflow via HTTP Host header with no user interaction (AV:N/AC:L/PR:N/UI:N); memory-corruption code execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 17:22 vuln.today

cvss_changed

Severity Changed

Jul 14, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

Jul 14, 2026 - 17:22 NVD

9.3 (CRITICAL) 8.9 (HIGH)

Analysis Generated

Jul 14, 2026 - 17:02 vuln.today

CVE Published

Jul 14, 2026 - 16:30 cve.org

CRITICAL 9.3

DescriptionCVE.org

A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of the component lighttpd. This manipulation of the argument Host causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Stack-based buffer overflow in the Totolink NR1800X router (firmware 9.1.0u.6279_B20210910) lets remote attackers corrupt memory by supplying an oversized HTTP Host header to the Form_Logout handler at /formLogout.htm, served by the embedded lighttpd web interface. Because the flaw is reachable over the network without authentication and publicly available exploit code exists, it is a strong candidate for opportunistic exploitation despite not yet appearing in CISA KEV. Successful exploitation can crash the device or, given the CWE-121 stack overwrite, potentially achieve code execution on the router.