Pre-authentication Buffer Overflow in TL-MR100 by TP-Link

CVE-2026-75118

What is CVE-2026-75118?

A pre-authentication stack-based buffer overflow vulnerability exists within the http_gdpr_decrypt function in TL-MR100 V3.20 due to inadequate bounds checking of encrypted requests directed to the /cgi/login endpoint. This vulnerability allows an adjacent unauthenticated attacker with access to the router's web management interface to initiate memory corruption. Successful exploitation can lead to the overwriting of control-flow data on the httpd process stack prior to user authentication, which can result in a service crash or potentially enables arbitrary code execution in the affected process context.

References