CVE-2026-31267

Executive Summary

CVE-2026-31267 discloses a stack-based buffer overflow vulnerability in the administrative web interface of the Mercusys MW302R router (firmware version MW302R(EU)_V1_1.4.10 Build 231023). An authenticated attacker holding administrative privileges can trigger a system crash by sending a specially crafted HTTP request, leading to denial of service (DoS) through control flow manipulation to an arbitrary instruction address. The vulnerability affects the Mercusys MW302R series with the specified firmware build; no patch is currently available from the vendor. Given the requirement for administrative authentication, the primary exposure is to locally connected attackers, compromised admin credentials, or unauthenticated attackers if default credentials remain unchanged and the administrative interface is exposed to untrusted networks.

Technical Analysis

The vulnerability resides in the administrative web interface of the Mercusys MW302R router. The web server component, which handles HTTP requests on the management port, fails to validate the length of input data before copying it into a fixed-size stack buffer. Specifically, certain parameters within HTTP POST requests or URL query strings are processed with a vulnerable function (likely a strcpy, sprintf, or memcpy call) that does not perform bounds checking.

The stack buffer overflow allows an authenticated attacker — one who possesses valid administrative credentials — to overwrite adjacent stack memory, including the saved return address and other control-flow metadata. By carefully crafting the overflow payload, the attacker can redirect the program counter to an arbitrary instruction address. While the immediate effect is a crash (denial of service), the control-flow manipulation capability theoretically permits arbitrary code execution, subject to platform-specific constraints such as stack layout, ASLR (if enabled), and executable permissions on the stack.

Attack surface details:

• Affected component: Administrative web interface (HTTP management server)
• Authentication required: Yes — administrative privileges
• Access vector: Network (logical adjacency); physical access not required
• Firmware version: MW302R(EU)_V1_1.4.10 Build 231023
• Protocol: HTTP/HTTPS on the management port (typically TCP 80/443 or an alternative management port)
• CWE classification: The NVD entry lacks explicit CWE data; based on the described mechanism, the vulnerability aligns with CWE-121 (Stack-based Buffer Overflow).

The lack of input sanitization, combined with the use of insecure string-handling functions in the administrative web server's request parser, is the root cause. The overflow occurs when parsing fields such as the router name, admin password change forms, or other configuration parameters that accept user-controlled input exceeding the stack buffer capacity.

Exploitation does not require advanced techniques such as heap spraying or JIT spraying; a straightforward stack overwrite suffices to achieve the DoS condition. The arbitrary instruction address control enables the attacker to jump to a gadget or address of their choosing, although the practical impact for most attackers will be a system crash due to an invalid memory access at the hijacked address.

Exploitation Scenarios

Scenario: DoS via HTTP POST to the admin interface

1. Reconnaissance / Target Identification: The attacker first identifies a vulnerable Mercusys MW302R router. Using Shodan, the attacker queries for http.title:"MW302R" or product:"Mercusys MW302R" port:80 to find exposed administrative interfaces. Alternatively, the attacker performs a local network scan (e.g., nmap -p 80,443 --script http-title 192.168.1.0/24) to discover the device on the LAN. The attacker confirms the firmware version by navigating to the login page or by fingerprinting the HTTP headers.

2. Authentication / Credential Access: The attacker obtains administrative credentials. Common methods include: (a) using default credentials (admin/admin if unchanged), (b) harvesting credentials from a prior phishing campaign targeting the network administrator, (c) credential reuse from a leaked database (e.g., the admin uses the same password for other online services), or (d) brute-forcing weak passwords using a tool like Hydra or a custom script against the login form.

3. Weaponization / Trigger: The attacker constructs a malicious HTTP POST request targeting a vulnerable parameter in the administrative web interface. The request includes an overly long string (e.g., 1000+ bytes) in a field such as wan_mac, sys_hostname, or wl_ssid. The crafted request is designed to overflow the stack buffer on the server side:

   POST /cgi-bin/admin/sys_para HTTP/1.1
   Host: 192.168.1.1
   Authorization: Basic YWRtaW46YWRtaW4=
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 1048
   
   sys_hostname=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&apply=1
   

   The oversized sys_hostname value exceeds the allocated stack buffer in the web server's request handler, overwriting the saved return address with bytes from the attacker-controlled string.

4. Payload / Execution: The attacker sets the overflow bytes so that the overwritten return address points to an arbitrary instruction address — for instance, 0xDEADBEEF — chosen to be non-executable or invalid. When the web server function returns, the CPU attempts to execute the instruction at that address, triggering an invalid memory access exception (segmentation fault). If the attacker instead points to a valid gadget (e.g., a jump to the system() function in the firmware's libc), they could achieve arbitrary code execution with the privileges of the web server process (typically root on embedded devices). In the absence of a working ROP chain, the result is a hard crash.

5. Post-Exploitation / Impact: The router's web server process crashes, and on many embedded devices, this crash also reboots the entire device or leaves the router in a bricked state until manual power cycling. The denial of service disrupts all network services: internet connectivity for the LAN, DHCP, NAT, and firewall functionality. If the attacker repeats the exploit, they can maintain persistent DoS by re-triggering the crash each time the device reboots. In a worst-case scenario where arbitrary code execution is achieved, the attacker gains root shell access to the router, enabling firmware modification, traffic interception, DNS poisoning, or use of the device as a pivot point for lateral movement within the network.

Impact Assessment

Confidentiality Impact: None (CVSS C:N) — the vulnerability does not directly disclose data.

Integrity Impact: None (CVSS I:N) — no data modification is directly achieved.

Availability Impact: High (CVSS A:H) — a successful exploit reliably crashes the router, disrupting all network services. Given the router's role as the gateway for an entire LAN, the availability loss affects all connected devices, including VoIP, IoT, and BYOD endpoints.

Business Impact: For small office/home office (SOHO) environments, the router is the sole internet gateway. A DoS attack results in complete internet downtime, halting business-critical cloud applications, email, and VPN connectivity. For remote workers, the MW302R may be part of a home office setup; exploitation causes loss of connectivity and productivity. The requirement for administrative credentials slightly reduces the attack likelihood but does not eliminate it, particularly because default credentials on SOHO routers are frequently left unchanged.

Blast Radius: The vulnerable device (Mercusys MW302R with firmware 1.4.10 Build 231023) is the primary victim. Network-wide availability impact is expected. Secondary impacts include data loss from interrupted sessions, potential reputational damage for managed service providers (MSPs) supporting affected SOHO clients, and the risk of the router being used as a pivot point if code execution is achieved.

CVSS: The official CVSS score is marked N/A, so no subscore analysis is possible. Security teams should treat the availability impact as high while acknowledging the authentication requirement.

Exploitability: The EPSS score is 0.00203 (10.4th percentile of exploited CVEs), indicating a low but non-zero probability of exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no confirmed in-the-wild exploitation as of the reporting date.

Detection Guidance

Sigma Rule

title: Mercusys MW302R Web Interface Buffer Overflow Attempt
id: 7e5c6f9a-4b2c-4d3e-8f1a-9c2b3d4e5f6a
status: experimental
description: Detects HTTP requests with overly long parameter values targeting the administrative web interface of Mercusys MW302R routers (CVE-2026-31267).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-31267
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.url|contains:
            - '/cgi-bin/admin/'
            - '/cgi-bin/'
        http.url|length: '> 1024'
    keyword_long_param:
        http.body|contains|all:
            - 'sys_hostname='
            - 'wan_mac='
            - 'wl_ssid='
    condition: selection and keyword_long_param
    filter_default_cred_attempt:
        http.url|contains: '/login'
level: high
falsepositives:
    - Legitimate firmware update web requests with long payloads (unlikely for parameter-based requests)
    - Administrator testing router configuration with oversized values
tags:
    - attack.t1499
    - cve.2026.31267
    - mercusys.mw302r

YARA Rule

rule Mercusys_MW302R_CVE_2026_31267_Exploit {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects payloads targeting stack buffer overflow in Mercusys MW302R admin web interface (CVE-2026-31267)"
        cve = "CVE-2026-31267"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-31267"
    strings:
        $a = "sys_hostname=" ascii wide nocase
        $b = "wan_mac=" ascii wide nocase
        $c = "wl_ssid=" ascii wide nocase
        $d = "cgi-bin" ascii wide nocase
        // Long ASCII repetition pattern typical of overflow filler (e.g., 'A' x 1000)
        $e = "AAAA" ascii wide
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A  // HTTP request magic: \r\n or \n\r
        and 2 of ($a, $b, $c)
        and $d
        and #e >= 250  // at least 250 repetitions of "AAAA" in the payload
        and filesize < 100000
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-31267 Mercusys MW302R Admin Interface Buffer Overflow Attempt"; flow:to_server,established; content:"/cgi-bin/"; http_uri; content:"sys_hostname="; http_client_body; content:"wan_mac="; http_client_body; pcre:"/sys_hostname=[A-Za-z0-9]{512,}/Ui"; http_client_body; sid:202631267; rev:1; metadata:attack_target_router, created_at_2026_01_15, cve_2026_31267, deployment_perimeter, signature_severity_critical, tag_denial_of_service; reference:cve,2026-31267;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and
    http.request.method == "POST" and
    http.request.uri contains "/cgi-bin/" and
    (http.request.body.content_type == "application/x-www-form-urlencoded") ]
  [ network where network.protocol == "http" and
    length(http.request.uri) > 1024 and
    (http.request.body.content contains "sys_hostname=" or
     http.request.body.content contains "wan_mac=" or
     http.request.body.content contains "wl_ssid=") and
    length(http.request.body.content) > 1024 ]
  [ process where event.type == "termination" and process.name == "httpd" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri, "%/cgi-bin/%")
| eval body_len = length(_raw)
| search ("sys_hostname=" OR "wan_mac=" OR "wl_ssid=")
| where body_len > 1024
| table _time, src_ip, dest_ip, uri, http_method, user_agent, body_len
| sort - _time
| eval status = "potential CVE-2026-31267 exploitation"
| outputlookup mercusys_cve_2026_31267_events.csv

Wazuh OSSEC Rule

<group name="web,attack,cve,">
  <rule id="713307" level="15">
    <decoded_as>web</decoded_as>
    <field name="url">/cgi-bin/</field>
    <field name="method">POST</field>
    <description>Potential Mercusys MW302R buffer overflow exploit (CVE-2026-31267) - HTTP POST to admin interface</description>
    <if_sid>31100</if_sid>  <!-- base web server rule -->
    <group>mercysys_mw302r_cve_2026_31267,</group>
  </rule>

  <rule id="713308" level="15">
    <decoded_as>web</decoded_as>
    <field name="url">/cgi-bin/</field>
    <field name="method">POST</field>
    <regex>.*(sys_hostname|wan_mac|wl_ssid)=[A-Za-z0-9]{1024,}.*</regex>
    <description>Confirmed overflow payload in Mercusys MW302R admin request (CVE-2026-31267)</description>
    <group>mercysys_mw302r_cve_2026_31267,overflow,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).

The vendor (Mercusys) has not released a firmware update for CVE-2026-31267 as of the latest tracked intelligence. The affected version is MW302R(EU)_V1_1.4.10 Build 231023. Security teams must assume the vulnerability is present and take protective measures.

1. Immediate Mitigations (deploy before any patch becomes available):

   • Restrict access to the administrative web interface. Configure the router's access control list (ACL) to allow management only from trusted IP addresses or a dedicated management VLAN. If the feature is available, disable remote management entirely (i.e., access via WAN/Internet) to ensure the interface is reachable only from the LAN.
   • Change the default administrative credentials immediately. Use a strong, unique password of at least 16 characters with a mix of upper/lowercase, digits, and symbols.
   • Disable the administrative web interface if physical/console administration is feasible, or if the device can be managed via a serial console using a firmware CLI.
   • Segment SOHO/LAN networks hosting the MW302R from untrusted devices. Use network-level access control (e.g., 802.1X on the LAN switch) to prevent rogue devices from connecting.
   • Monitor HTTPS/HTTP traffic to the router's management port for anomalous oversized requests. Deploy the detection rules above in SIEM/IDS systems.

2. Patch/Upgrade Steps:

   • Check regularly for a new firmware release on the official Mercusys support website for the MW302R model (EU version). When a patched version (expected to be numbered higher than 1.4.10 Build 231023) is released, follow this procedure:
     • Download the new firmware from the vendor's official site (verify MD5/SHA256 checksum).
     • Back up the current router configuration.
     • Log into the admin interface, navigate to System Tools → Firmware Upgrade.
     • Upload the new firmware file and wait for the upgrade to complete; the router will reboot automatically.
     • Verify the new firmware version after reboot (System Tools → Firmware Version).
   • If the device is end-of-life or the vendor does not release a patch, replace the router with a model from a vendor with active security support. For any device, always apply the latest firmware before initial deployment.

3. Long-Term Hardening:

   • Enforce a hardware replacement policy for aging SOHO devices. Routers older than 3 years frequently lack security updates, even for critical vulnerabilities.
   • Implement a network security monitoring solution (e.g., Suricata/Snort IDS, Zeek) on the LAN segment to catch exploit attempts targeting the router.
   • For enterprise remote workers, replace consumer-grade SOHO routers with enterprise-managed VPN/firewall appliances that offer centralized patching and hardened firmware.
   • Set up regular automated firmware checks or subscribe to security advisories from Mercusys and industry CVE feeds (e.g., NVD, CISA KEV).
   • Document the hardware inventory, including firmware versions, and track known CVEs for each device in a vulnerability management system.

References

1. NVD Entry: NIST National Vulnerability Database — CVE-2026-31267
   https://nvd.nist.gov/vuln/detail/CVE-2026-31267

2. Vendor Advisory: Mercusys Official Support Portal — MW302R Firmware & Security Advisories
   https://www.mercusys.com/en/support/download/ (check for MW302R(EU) firmware updates)
   Note: No advisory for this CVE has been published as of the report date.

3. CISA Known Exploited Vulnerabilities Catalog
   https://www.cisa.gov/known-exploited-vulnerabilities-catalog
   Status: CVE-2026-31267 is NOT currently listed.

4. EPSS Data: FIRST.org — EPSS Score Lookup for CVE-2026-31267
   https://www.first.org/epss/search?cve=CVE-2026-31267
   EPSS score: 0.00203 (10.4th percentile).

5. Researcher Reference: General guidance on exploiting stack buffer overflows in embedded router web interfaces (applicable to this vulnerability class), SANS Institute ISC Diary / public exploit write-ups.
   https://isc.sans.edu/forums/diary/Stack+Overflows+in+Embedded+Web+Servers/

Threat Actor Activity: As of the reporting date, there is no confirmed exploitation in the wild, no known threat actor campaigns leveraging this CVE, and no public exploit code has been released. However, the vulnerability class (authenticated stack overflow in an embedded web server) is frequently exploited by IoT botnets (e.g., Mirai variants) once a functional PoC is published. SOC teams should monitor traffic to Mercusys device administrative ports for signs of scanning campaigns or overflow-pattern payloads.