CVE-2026-15701 is a stack-based buffer overflow vulnerability affecting Totolink NR1800X firmware version 9.1.0u.6279_B20210910. The vulnerability resides in the Form_Logout function of the /formLogout.htm file in the lighttpd component. An attacker can remotely trigger this overflow by manipulating the Host argument, potentially leading to arbitrary code execution or denial of service. Public exploit code is available, increasing the risk of exploitation. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. Given the critical CVSS score of 9.3 and the availability of public exploit code, the risk of exploitation is significant.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, consider restricting network access to the affected device's management interface to trusted sources only to reduce exposure.