CVE-2026-85384: CWE-121 Stack-based buffer overflow in TP-Link Systems Inc. RE210 AC750

This vulnerability (CWE-121) exists in the RE210 AC750 router's httpd service due to insufficient bounds checking in the splitString function during configuration file processing. An attacker with local network authentication can upload a malicious configuration file that triggers a stack-based buffer overflow, enabling remote code execution. The CVSS 4.0 score is 8.5, reflecting high severity with attack vector local network, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized access to sensitive information, modification of device configuration and network behavior, or disruption of device availability. This could allow an attacker to gain control over the device remotely, impacting network security and stability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's management interface to trusted users only and monitor for suspicious activity on the local network.