CyberRota Analysis
AI-GeneratedA stack-based buffer overflow vulnerability in the http_gdpr_decrypt function of TL-MR100 V3.20 allows unauthenticated attackers with access to the router's web management interface to exploit insufficient bounds checking on encrypted requests. This can lead to memory corruption, potentially enabling arbitrary code execution or service crashes before authentication occurs. Organizations using this router model should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution. Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process.