The vulnerability CVE-2026-7546 affects the Totolink NR1800X router firmware 9.1.0u.6279_B20210910 and is caused by a stack-based buffer overflow in the find_host_ip function within the lighttpd component. An attacker can remotely exploit this by sending a specially crafted Host argument, leading to memory corruption. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and can be executed over the network with low complexity, resulting in high confidentiality, integrity, and availability impacts. The vulnerability is publicly disclosed but lacks an official vendor patch or mitigation at this time.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. The critical CVSS score of 9.3 reflects the potential for complete compromise of the router's functionality and security. No confirmed exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of the affected device to untrusted networks and monitor for updates from Totolink. No vendor-provided mitigation or temporary fix is currently documented.