CVE-2026-31267 describes a stack buffer overflow vulnerability in the administrative web interface of Mercusys MW302R MW302R(EU)_V1_1.4.10 Build 231023. An attacker with administrative privileges who is authenticated can send a specially crafted request to trigger this overflow, causing the system to crash. This vulnerability leads to denial of service by hijacking control flow to an arbitrary instruction address. The CVSS v3.1 base score is 5.7 (medium severity), reflecting low attack vector complexity and required privileges but no confidentiality or integrity impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows an authenticated administrator to cause a denial of service by crashing the device through a stack buffer overflow. There is no impact on confidentiality or integrity. The device's availability is affected due to control flow manipulation leading to system crash. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for unusual administrative activity. No official fix or temporary workaround has been published.