CVE-2026-31267: Mercusys MW302R Buffer Overflow DoS Vulnerability – Patch & Detection Guide

Technical summary

CVE-2026-31267 is a stack buffer overflow (CWE-121) in the Mercusys MW302R administrative interface. The vulnerability exists in firmware version MW302R(EU)_V1_1.4.10 Build 231023. An authenticated attacker with administrative privileges can craft a malicious HTTP request to the web management interface that overflows a stack-allocated buffer, corrupting the return address and redirecting control flow to an arbitrary instruction. The attack requires network access to the administrative interface and valid admin credentials, but requires no user interaction. The result is uncontrolled application termination and device unavailability.

Business impact

Router unavailability directly impacts network connectivity and service delivery. An administrator with malicious intent—or an attacker who has compromised admin credentials through phishing, weak passwords, or lateral movement—can render the device inoperative, forcing manual recovery and downtime. For small office/branch deployments relying on this model, an outage can disrupt internet access, VoIP, and LAN services until the device is rebooted or replaced. Organizations should assess the likelihood of admin credential compromise in their threat model.

Affected systems

Mercusys MW302R (EU variant) running firmware version 1.4.10 Build 231023 is confirmed affected. Older and newer firmware versions of this model, as well as other Mercusys router models, may be affected but have not been explicitly confirmed in available disclosures. Administrators should check their deployed firmware versions and consult Mercusys support documentation for the scope of impact across product variants.

Exploitability

Exploitability is moderate. The attacker must already possess valid administrative credentials and network access to the device's management interface—a significant barrier in most deployments where admin access is restricted to trusted networks or VPNs. No user interaction is required once authenticated. The attack is reliable and straightforward to execute with basic crafted requests, but the prerequisite of admin access substantially limits real-world attack surface. This vulnerability is not in the CISA Known Exploited Vulnerabilities (KEV) catalog and does not yet show signs of active exploitation in the wild.

Remediation

Firmware updates from Mercusys are the definitive fix. Administrators should verify the latest available firmware version for the MW302R and apply it as soon as possible. Until a patch is available, mitigate risk by restricting administrative interface access to trusted IP ranges, enforcing strong admin passwords, disabling remote administration if not required, and monitoring admin login attempts for unauthorized access.

Patch guidance

Contact Mercusys support or visit their firmware download portal to obtain the latest firmware version for the MW302R(EU) variant. Verify the build number and changelog to confirm the buffer overflow is addressed. Test the firmware in a non-production environment before rolling out to all devices. Most Mercusys routers allow firmware updates through the web interface under System Tools or Administration; ensure you have a stable power supply during the update to prevent corruption. Verify functionality after upgrade, including LAN/WAN connectivity and administrative access.

Detection guidance

Monitor administrative web interface logs for unusual HTTP requests or failed login attempts that might indicate credential compromise. Implement network-based detection rules to alert on suspicious payloads sent to the admin interface port (typically 80 or 443). Stack overflow attempts often contain large or malformed fields in POST requests. Baseline normal admin traffic and flag anomalies. Consider deploying intrusion detection signatures if your security tools support Mercusys device monitoring. Endpoint detection on admin machines should alert on compromised admin sessions or unauthorized lateral movement attempts.

Why prioritize this

A CVSS 5.7 MEDIUM severity rating reflects the limited exploitability (requires authenticated admin access) balanced against a guaranteed denial-of-service outcome. Prioritization depends on your deployment: if MW302R devices are critical in your infrastructure or if admin credentials are difficult to protect (e.g., shared accounts, default passwords), elevate priority. Organizations with robust network segmentation and strong credential hygiene can address this in routine patching cycles. However, the lack of KEV status and public exploitation does not mean you should delay indefinitely—admin credential compromise is a realistic risk in many threat scenarios.

Risk score, explained

The CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H vector yields 5.7 MEDIUM. Breakdown: AV:A (Attack Vector Adjacent Network) indicates the attacker must be on the same network segment or have network access to the device; AC:L (Attack Complexity Low) means no special conditions are needed; PR:L (Privileges Required Low) reflects the admin credential requirement; UI:N (User Interaction None) confirms no user action is needed; S:U (Scope Unchanged) means the impact is confined to the affected device; C:N, I:N (Confidentiality and Integrity None) indicate no data breach or modification; A:H (Availability High) reflects complete denial of service. The score appropriately captures a serious but not critical outage risk in a confined scope.

Frequently asked questions