CVE-2026-15701 Totolink NR1800X lighttpd formLogout.htm Form_Logout stack-based overflow
A remote attacker can trigger a stack-based buffer overflow in the Totolink NR1800X router's logout function, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15701?
CVE-2026-15701 is a critical memory corruption vulnerability in Totolink NR1800X, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of the component lighttpd. This manipulation of the argument Host causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Which versions are affected by CVE-2026-15701?
How do I fix CVE-2026-15701?
No fix has been published for CVE-2026-15701 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-15701 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-15701 exists.
Sources
Also known as GHSA-4p43-rxhv-xw72.