CVE-2026-75118: TL-MR100 Buffer Overflow Vulnerability

CVE-2026-75118 Overview

CVE-2026-75118 is a pre-authentication stack-based buffer overflow in the http_gdpr_decrypt function of the TP-Link TL-MR100 V3.20 router firmware. The flaw stems from insufficient bounds checking of encrypted requests sent to the /cgi/login endpoint. An unauthenticated attacker with adjacent-network access to the router's web management interface can corrupt stack memory in the httpd process. Successful exploitation may crash the service or lead to arbitrary code execution in the context of the web server, before any authentication check is performed. The vulnerability is classified as [CWE-121] Stack-based Buffer Overflow.

Critical Impact
An adjacent unauthenticated attacker can overwrite saved control-flow data on the httpd process stack, resulting in denial of service or arbitrary code execution on the router.

Affected Products

TP-Link TL-MR100 router, firmware version V3.20
The vulnerable component is the http_gdpr_decrypt handler in the embedded httpd binary
Exposure is scoped to the router's web management interface reachable from adjacent networks (LAN, Wi-Fi)

Discovery Timeline

2026-08-28 - CVE-2026-75118 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75118

Vulnerability Analysis

The TL-MR100 web management interface accepts encrypted payloads at the /cgi/login endpoint as part of its GDPR-style privacy handshake. The http_gdpr_decrypt function processes these encrypted request bodies before authentication is enforced. Because the function does not validate the length of attacker-controlled input against the destination stack buffer, oversized payloads write past the buffer boundary. The overflow corrupts adjacent stack frames, including the saved return address and register values of the httpd process. Exploitation requires only network reachability to the router's management interface, making any client on the LAN or Wi-Fi segment a viable attacker. The pre-authentication nature of the flaw removes credential requirements entirely.

Root Cause

The root cause is missing bounds checking on the encrypted request buffer inside http_gdpr_decrypt. The decryption routine copies attacker-supplied ciphertext into a fixed-size stack buffer without validating the declared or actual input length. This is a classic [CWE-121] stack-based buffer overflow pattern common in embedded MIPS/ARM httpd binaries derived from BusyBox-style implementations. No stack canaries, ASLR, or NX enforcement are documented on the affected firmware image, which increases exploitability of control-flow hijacking.

Attack Vector

The attack vector is adjacent network. An attacker on the same broadcast domain as the router, including guest Wi-Fi or a compromised LAN client, sends a crafted HTTP POST request to /cgi/login. The request body contains an oversized encrypted blob that triggers the overflow during decryption. No credentials, user interaction, or prior compromise of the router is required.

No verified public exploit code is available for CVE-2026-75118. The vulnerability mechanism is described in prose per the referenced advisories; see the TP-Link TL-MR100 Firmware Download and TP-Link Support FAQ #5271 for vendor guidance.

Detection Methods for CVE-2026-75118

Indicators of Compromise

Unexpected crashes, restarts, or watchdog reboots of the router's httpd process or full device reboots correlated with LAN-side HTTP traffic
HTTP POST requests to /cgi/login containing abnormally large request bodies or malformed encrypted payloads
New or unexpected outbound connections originating from the router itself following exposure of the management interface

Detection Strategies

Inspect network traffic on the management VLAN for POST requests to /cgi/login with body sizes exceeding expected login payload lengths
Correlate router syslog entries reporting httpd segmentation faults or restarts with client-side HTTP activity
Monitor for scanning behavior targeting TP-Link management interface fingerprints on internal segments

Monitoring Recommendations

Forward router syslog and SNMP traps to a central log platform and alert on repeated httpd process termination events
Baseline the volume and size distribution of /cgi/login requests, and alert on statistical outliers
Track authentication and configuration-change events on the router to identify post-exploitation persistence attempts

How to Mitigate CVE-2026-75118

Immediate Actions Required

Restrict access to the router's web management interface to a dedicated management VLAN or trusted host, and disable remote management from WAN
Disable Wi-Fi guest networks or isolate them from the management SSID so untrusted clients cannot reach /cgi/login
Inventory all TL-MR100 devices running firmware V3.20 and prioritize them for firmware updates or replacement

Patch Information

At the time of publication, no fixed firmware version is listed in the NVD entry for CVE-2026-75118. Administrators should consult the TP-Link TL-MR100 Firmware Download page and TP-Link Support FAQ #5271 for updated firmware releases and vendor mitigation guidance. Apply any TP-Link firmware update that supersedes V3.20 as soon as it becomes available.

Workarounds

Place the router behind a network segment where only administrator workstations can reach TCP/80 and TCP/443 of the management interface
Change the default management interface port and enforce strong administrator credentials to reduce opportunistic targeting
Where feasible, replace end-of-support TL-MR100 units with hardware that receives active security maintenance

bash

# Example: restrict management interface access using an upstream firewall (iptables)
# Allow only the admin workstation 10.10.0.5 to reach the router at 192.168.1.1
iptables -A FORWARD -s 10.10.0.5 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 10.10.0.5 -d 192.168.1.1 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 443 -j DROP