CVE-2026-75118: tp-link systems inc. tl-mr100 v3.20 Stack-based Buffer Overflow

Vulnerability summary

CVE-2026-75118 is a high (CVSS 8.7) Stack-based Buffer Overflow vulnerability in tp-link systems inc. tl-mr100 v3.20. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 30.2% of scored vulnerabilities.

Timeline

1. 28-08-2026
   PublishedVulnerability first disclosed.
2. 01-09-2026
   Last modifiedVulnerability information updated.

Description

A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution. Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).