EUVD-2026-67944
GHSA-p3fv-q9vc-j25p
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector matches web management interface constraint; PR:N confirmed pre-auth; S:U as impact is contained to the router's httpd process with no scope change indicated.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
2DescriptionCVE.org
A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution.
Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process.
AnalysisAI
Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network adjacency to the router's web management interface - the attacker must be on the same LAN segment or Wi-Fi network, or otherwise able to reach the management HTTP/HTTPS service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with AV:A (Adjacent Network) is the dominant risk-shaping factor: exploitation is constrained to attackers who can reach the router's web management interface from the same network segment - LAN clients, Wi-Fi-connected devices, or in some ISP configurations, adjacent CPE networks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the vendor-released firmware update for TL-MR100 V3.20, available from TP-Link's official firmware download page at https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware; the advisory at https://www.tp-link.com/en/support/faq/5271/ provides guidance on the update process. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all TP-Link TL-MR100 devices deployed across the organization and confirm which models are running version V3.20 or earlier; immediately restrict network access to the web management interface on these devices to authorized administrators only if patching cannot be deployed immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today