CVE-2026-75118: http_gdpr_decrypt Pre-Authentication Stack-Based Buffer Overflow
A pre-authentication stack-based buffer overflow vulnerability exists in the httpgdprdecrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution.
Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker must be adjacent to the target and able to reach the router's web management interface. Authentication is not required because the vulnerable /cgi/login endpoint is processed before login.
What access or request is needed to trigger the vulnerability?
The attacker needs to send a crafted encrypted request to the /cgi/login endpoint. The issue is caused by insufficient bounds checking in http_gdpr_decrypt while handling that request.
What could exploitation cause?
Exploitation can corrupt memory in the httpd process, causing a service crash. It may also overwrite saved control-flow data and potentially allow arbitrary code execution in the affected process context.