What is the CVSS score of CVE-2026-31267?

CVE-2026-31267 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Mercusys MW302R CVE-2026-31267

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-07-09 cve@mitre.org

Buffer Overflow Denial Of Service Stack Overflow

5.7

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.7 MEDIUM

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.5 MEDIUM

Description explicitly requires administrative privileges (PR:H); AV:A retained per CVSS vector; DoS-only impact confirmed by description (C:N, I:N, A:H).

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 16:33 vuln.today

CVSS changed

Jul 10, 2026 - 16:22 NVD

5.7 (MEDIUM)

CVE Published

Jul 09, 2026 - 21:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Mercusys MW302R MW302R(EU)_V1_1.4.10 Build 231023 is vulnerable to Buffer Overflow in the administrative web interface. A stack buffer overflow vulnerability in the administrative web interface allows an authenticated attacker with administrative privileges to trigger a system crash by sending a specially crafted request. The vulnerability results in denial of service through control flow manipulation to an arbitrary instruction address.

AnalysisAI

Stack-based buffer overflow in the Mercusys MW302R (EU) V1 1.4.10 Build 231023 administrative web interface allows an authenticated attacker with administrative access on the same network segment to crash the device by sending a specially crafted HTTP request. The crash results from control flow being redirected to an arbitrary instruction address - a classic CWE-121 stack overflow pattern that produces denial of service. No public exploit is confirmed in CISA KEV, though a researcher GitHub gist (BarrYPL/13dcd071673866cbbfaaa05085b98cf3) appears to document the finding and may constitute a proof-of-concept write-up. EPSS probability is very low at 0.16% (6th percentile), consistent with a niche consumer router model.

Technical ContextAI

CWE-121 (Stack-based Buffer Overflow) describes a condition where a function writes beyond the bounds of a fixed-size stack-allocated buffer, potentially overwriting saved return addresses or function pointers. In this case, the vulnerable code resides in the HTTP request handler of the MW302R's administrative web interface - firmware version MW302R(EU)_V1_1.4.10 Build 231023. The CVSS vector AV:A (Adjacent Network) indicates the admin interface is exposed only within the local network segment, consistent with a typical home/SOHO router LAN management interface rather than a WAN-facing service. The overflow causes control flow to be redirected to an arbitrary instruction address (per the description), which in this firmware context results in a crash rather than demonstrated code execution, producing a denial of service. No CPE string was provided in the intelligence data; the affected product is identified solely by the vendor-specified version string in the CVE description.

Affected ProductsAI

The confirmed affected product is the Mercusys MW302R router, specifically firmware version MW302R(EU)_V1_1.4.10 Build 231023 for the EU hardware variant V1. No CPE string was provided in the intelligence data, and no vendor advisory URL is available among the references. The only references are the reporter's personal site (https://barry-dev.xyz/about) and a GitHub gist (https://gist.github.com/BarrYPL/13dcd071673866cbbfaaa05085b98cf3) that appears to be a researcher disclosure. Whether other firmware versions or regional hardware variants are affected is unknown from available data.

RemediationAI

No vendor-released patch has been identified at the time of analysis - neither reference points to a Mercusys security advisory or firmware update. Users running MW302R(EU)_V1_1.4.10 Build 231023 should monitor the Mercusys support page for firmware updates addressing this vulnerability. As a compensating control, restrict administrative web interface access to trusted management hosts only by using the router's ACL or firewall features if available, which limits the pool of potential attackers even within the LAN. Disabling remote management (if exposed on LAN to untrusted segments) further reduces exposure. Since exploitation requires admin credentials, enforcing a strong, unique administrative password reduces the risk of credential-based access that would allow this vulnerability to be triggered. Note that these controls do not eliminate the vulnerability - they reduce the probability that an attacker reaches the condition required to trigger the overflow. A firmware upgrade from Mercusys remains the definitive fix.