A pre‑authentication stack‑based buffer overflow in the http_gdpr_decrypt function of TP‑Link TL‑MR100 firmware v3.20 allows an attacker who can send encrypted requests to the /cgi/login web endpoint to corrupt the httpd process stack. The overflow can overwrite return pointers and other control data, potentially causing a crash or enabling arbitrary code execution on the router. Due to the absence of bounds checking in this function, the vulnerability can be triggered before any authentication is performed, exposing a critical risk.

This issue affects TP‑Link Systems Inc. TL‑MR100 routers running firmware version 3.20. No other firmware revisions or TP‑Link models are known to be impacted according to the vendor’s public information.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can reach the router’s local network and access the web management interface could exploit the overflow without authentication, leading to memory corruption and potentially arbitrary code execution. Because the vulnerability requires proximity to the router’s interface, attackers would typically need local network access or a compromised device on the same LAN. Given the lack of advanced detection or rate limiting in the firmware, successful exploitation could be straightforward if an attacker can communicate with the affected endpoint. This makes the vulnerability a significant risk for environments where the router’s management interface is accessible from untrusted devices.