TP-Link TL-MR100 EUVD-2026-67944

Exploitation requires network adjacency to the router's web management interface - the attacker must be on the same LAN segment or Wi-Fi network, or otherwise able to reach the management HTTP/HTTPS service. No authentication is required (pre-auth vulnerability, CVSS PR:N). No special router configuration is required beyond the default-enabled web management interface. Limiting factors: (1) AV:A constrains exploitation to adjacent-network attackers, excluding arbitrary internet-based attackers unless the management interface is explicitly exposed to a WAN; (2) exploitation requires memory corruption success - the practical reliability of achieving RCE versus a crash depends on firmware ASLR/stack canary mitigations, which are not confirmed in the provided data; (3) no public exploit code exists at time of analysis, requiring attacker capability to independently develop working exploit code.

The CVSS 4.0 score of 8.7 with AV:A (Adjacent Network) is the dominant risk-shaping factor: exploitation is constrained to attackers who can reach the router's web management interface from the same network segment - LAN clients, Wi-Fi-connected devices, or in some ISP configurations, adjacent CPE networks. This eliminates arbitrary internet-based attackers but does not eliminate meaningful threat actors, particularly in shared-network environments (apartment buildings, co-working spaces, hospitality Wi-Fi, or compromised LAN devices pivoting laterally). The PR:N/UI:N pre-authentication nature means no credentials or user interaction are required once adjacency is achieved, which raises operational urgency. No EPSS data was provided in the input, and no CISA KEV listing exists at time of analysis, suggesting exploitation has not been observed at scale. The absence of a public POC further limits near-term automated exploitation risk. However, the RCE potential on network infrastructure (a router) is high-value: a compromised httpd process on the router could enable traffic interception, persistence, or lateral movement into the protected LAN. CVSS and description are consistent - no conflicting signals detected. The adjacent-vector constraint is the primary reason this does not warrant the same urgency as a fully network-reachable pre-auth RCE, but the impact ceiling remains high.

An attacker connected to the same Wi-Fi network or LAN segment as a TL-MR100 V3.20 router crafts an HTTP request to the /cgi/login endpoint containing an oversized encrypted payload designed to overflow the stack buffer in http_gdpr_decrypt. The overflow overwrites the saved return address with an attacker-controlled value, redirecting execution upon function return to shellcode or a ROP chain, achieving code execution as the httpd process without requiring any credentials. No public POC has been identified at time of analysis, so exploitation requires independent reverse engineering of the firmware.