Refine your search

2 vulnerabilities found for TL-MR100 v3.20 by TP-Link Systems Inc.

CVE-2026-75118 (GCVE-0-2026-75118)
Vulnerability from cvelistv5
Published
2026-08-28 20:31
Modified
2026-08-28 20:31
Severity ?
8.7 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-121 - Stack-based buffer overflow
Summary
A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution. Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process.
References
Impacted products
Vendor Product Version
TP-Link Systems Inc. TL-MR100 v3.20 Version: 0   < (EU)_1.3.0 Build 260609
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "/usr/bin/httpd"
          ],
          "product": "TL-MR100 v3.20",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.3.0 Build 260609",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kylian Eury"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eA pre-authentication stack-based buffer overflow vulnerability exists in the \u003ccode\u003ehttp_gdpr_decrypt\u003c/code\u003e function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the \u003ccode\u003e/cgi/login\u003c/code\u003e endpoint. An adjacent unauthenticated attacker with access to the router\u0027s web management interface can trigger memory corruption and potentially achieve arbitrary code execution.\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\n\u003cdiv\u003eSuccessful exploitation can overwrite saved control-flow data on the \u003ccode\u003ehttpd\u003c/code\u003e process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process.\u003c/div\u003e"
            }
          ],
          "value": "A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router\u0027s web management interface can trigger memory corruption and potentially achieve arbitrary code execution.\n\n\n\n\n\n\n\nSuccessful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T20:31:03.977Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/en/support/faq/5271/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "http_gdpr_decrypt Pre-Authentication Stack-Based Buffer Overflow",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2026-75118",
    "datePublished": "2026-08-28T20:31:03.977Z",
    "dateReserved": "2026-08-17T18:18:43.498Z",
    "dateUpdated": "2026-08-28T20:31:03.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12339 (GCVE-0-2026-12339)
Vulnerability from cvelistv5
Published
2026-08-10 18:20
Modified
2026-08-25 23:31
Severity ?
6.9 (Medium) - CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.
References
Impacted products
Vendor Product Version
TP-Link Systems Inc. TL-MR6400 v5.3 Version: 0   < (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n
 Create a notification for this product.
   TP-Link Systems Inc. Archer MR600 v2 Version: 0   < (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n
 Create a notification for this product.
   TP-Link Systems Inc. Archer MR200 v7 Version: 0   < (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n
 Create a notification for this product.
   TP-Link Systems Inc. TL-MR6400 v8.0 Version: 0   < (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n
 Create a notification for this product.
   TP-Link Systems Inc. TL-MR150 v3.20 Version: 0   < (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n
 Create a notification for this product.
   TP-Link Systems Inc. TL-MR100 v3.20 Version: 0   < (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n
Version: 0   < 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n,  Customized Software for South Korea KT
Version: 0   < 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12339",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T14:44:35.924185Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T14:44:53.124Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "TL-MR6400 v5.3",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Archer MR600 v2",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Archer MR200 v7",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TL-MR6400 v8.0",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TL-MR150 v3.20",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TL-MR100 v3.20",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, \u00a0Customized Software for South Korea KT",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "MrBruh"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "haehet"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.\u003cdiv\u003eSuccessful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability. \u003c/div\u003e"
            }
          ],
          "value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.Successful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-17",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-17 Using Malicious Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T23:31:52.397Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/en/support/faq/5237/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authenticated Arbitrary File Write Vulnerability in multiple devices",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2026-12339",
    "datePublished": "2026-08-10T18:20:50.576Z",
    "dateReserved": "2026-06-15T15:51:52.827Z",
    "dateUpdated": "2026-08-25T23:31:52.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}