CVE-2026-85384 Overview
CVE-2026-85384 is a stack-based buffer overflow vulnerability in the httpd component of the TP-Link RE210 AC750 range extender. The flaw stems from improper bounds checking in the splitString function when the device processes an uploaded configuration file. An authenticated attacker on the adjacent network can upload a crafted configuration file to overflow the stack buffer and achieve remote code execution on the device. Successful exploitation allows unauthorized access to sensitive information, modification of device configuration and network behavior, and disruption of device availability. The weakness is classified under [CWE-121: Stack-based Buffer Overflow].
Critical Impact
An authenticated adjacent-network attacker can achieve remote code execution on the RE210 AC750 by uploading a malformed configuration file, gaining full control over the device.
Affected Products
- TP-Link RE210 AC750 range extender (httpd component)
- Specific firmware versions are not enumerated in the published advisory
- Refer to the TP-Link Support FAQ for vendor guidance
Discovery Timeline
- 2026-09-08 - CVE-2026-85384 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-85384
Vulnerability Analysis
The vulnerability resides in the splitString helper used by the embedded httpd web server on the RE210 AC750. When a user uploads a configuration file through the administrative web interface, splitString parses the file contents and copies fields into a fixed-size stack buffer without validating the length of each token. A configuration file containing an oversized field overflows the destination buffer, corrupting adjacent stack memory including the saved return address.
Because httpd runs with elevated privileges on the device, successful memory corruption yields code execution in that context. Attackers can leverage this to install persistent implants, pivot to other network segments, or modify DNS and routing behavior to intercept client traffic. The attack requires authentication and adjacent network access, but embedded consumer devices frequently reuse default or weak credentials in home and small office deployments.
Root Cause
The root cause is missing bounds validation on tokens produced by splitString before they are written to a stack-allocated buffer. The function trusts the length of input fields derived from the uploaded configuration file, violating safe string handling practices for untrusted input [CWE-121].
Attack Vector
Exploitation requires an authenticated session on the RE210 web management interface and network adjacency to reach the device. The attacker submits a crafted configuration file through the standard configuration import functionality. Parsing the file inside splitString triggers the overflow, allowing the attacker to overwrite the saved return address and redirect execution to attacker-controlled memory. No verified public proof-of-concept code is available at the time of publication.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-85384
Indicators of Compromise
- Unexpected HTTP POST requests to the RE210 configuration import endpoint from local network hosts
- Configuration file uploads with abnormally large field values or malformed structure
- Unplanned reboots, crashes, or httpd service restarts on the range extender
- Changes to DNS, routing, or firewall settings on the device that were not made by an administrator
Detection Strategies
- Inspect network traffic to the RE210 management interface for configuration upload requests originating from non-administrative hosts
- Correlate authentication events with subsequent configuration import operations to identify unusual patterns
- Monitor syslog or remote logging output from the device for httpd process crashes and segmentation faults
Monitoring Recommendations
- Place the range extender on a segmented management VLAN and log all traffic to and from the administrative interface
- Alert on repeated failed logins to the RE210 web UI followed by successful authentication
- Track outbound connections from the device to unfamiliar external hosts, which may indicate a post-exploitation callback
How to Mitigate CVE-2026-85384
Immediate Actions Required
- Restrict access to the RE210 management interface to trusted administrative hosts only
- Change any default or reused administrative credentials on the device to strong, unique values
- Disable remote administration and limit access to the local wired management network where feasible
- Review recent configuration changes and audit device settings for unauthorized modifications
Patch Information
At the time of publication, no specific firmware patch version is listed in the CVE record. Administrators should consult the TP-Link Support FAQ for updated firmware releases and apply any vendor-supplied fixes for the RE210 AC750 as soon as they are available.
Workarounds
- Isolate the RE210 on a dedicated network segment with access control lists restricting who can reach TCP port 80 and 443 on the device
- Avoid importing configuration files from untrusted sources or shared administrator accounts
- Consider replacing end-of-life range extenders with vendor-supported models that receive ongoing security updates
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
