CVE-2026-75118

CVE-2026-75118 is a pre-authentication stack-based buffer overflow (CWE-121) in the http_gdpr_decrypt function of the web server on the TP-Link TL-MR100 router running V3.20. An adjacent, unauthenticated attacker who can reach the router's web management interface can send a crafted encrypted request to the /cgi/login endpoint, where insufficient bounds checking lets data overflow a stack buffer and overwrite saved control-flow data on the httpd process stack. Successful exploitation can crash the httpd service or potentially achieve arbitrary code execution in the context of that process, with high impact on confidentiality, integrity, and availability (CVSS 4.0 score 8.7). Only TL-MR100 units on the affected V3.20 firmware whose management interface is reachable from an adjacent network (e.g., untrusted LAN users or WAN-side management) are at risk. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates a 0.3% probability of exploitation within 30 days.

What to do: Check the hardware/firmware version of your TL-MR100 in the web management interface and update to the latest TP-Link firmware for the device once a fixed release is published (no fixed version is specified in the available data). Until patched, restrict access to the web management interface to trusted LAN clients, disable WAN-side or remote management if enabled, and prevent untrusted devices from reaching /cgi/login.