Refine your search

2 vulnerabilities found for TL-MR6400 v8.0 by TP-Link Systems Inc.

CVE-2026-8619 (GCVE-0-2026-8619)
Vulnerability from cvelistv5
Published
2026-08-19 23:11
Modified
2026-08-20 16:27
Severity ?
7.1 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-476 - NULL pointer dereference
Summary
An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference.  A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable.
References
Impacted products
Vendor Product Version
TP-Link Systems Inc. TL-MR100 v3.2 Version: 0   < TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957n
 Create a notification for this product.
   TP-Link Systems Inc. TL-MR150 v.3.2 Version: 0   < TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n
 Create a notification for this product.
   TP-Link Systems Inc. TL-MR6400 v8.0 Version: 0   < TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978n
 Create a notification for this product.
   TP-Link Systems Inc Archer MR600 v2 Version: 0   < Archer MR600(EU)_V2_1.10.0 Build 260618
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8619",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T16:03:32.689670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T16:27:30.130Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "TL-MR100 v3.2",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "TL-MR150 v.3.2",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "TL-MR6400 v8.0",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Archer MR600 v2",
          "vendor": "TP-Link Systems Inc",
          "versions": [
            {
              "lessThan": "Archer MR600(EU)_V2_1.10.0 Build 260618",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "haehet"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn\nunauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions\nthat may lead to a NULL pointer dereference.\u0026nbsp;\nA remote attacker on an adjacent network can send a specially crated\nHTTP request to trigger a crash of the HTTP service process.\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may cause the HTTP service to crash, making the web management\ninterface and HTTP-dependent functionality temporarily unavailable.\u0026nbsp;\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "An\nunauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions\nthat may lead to a NULL pointer dereference.\u00a0\nA remote attacker on an adjacent network can send a specially crated\nHTTP request to trigger a crash of the HTTP service process.\n\n\n\n\n\nSuccessful\nexploitation may cause the HTTP service to crash, making the web management\ninterface and HTTP-dependent functionality temporarily unavailable."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-125",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-125 Flooding"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL pointer dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T23:11:51.163Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/us/support/faq/5253/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2026-8619",
    "datePublished": "2026-08-19T23:11:51.163Z",
    "dateReserved": "2026-05-14T18:04:19.124Z",
    "dateUpdated": "2026-08-20T16:27:30.130Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12339 (GCVE-0-2026-12339)
Vulnerability from cvelistv5
Published
2026-08-10 18:20
Modified
2026-08-25 23:31
Severity ?
6.9 (Medium) - CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.
References
Impacted products
Vendor Product Version
TP-Link Systems Inc. TL-MR6400 v5.3 Version: 0   < (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n
 Create a notification for this product.
   TP-Link Systems Inc. Archer MR600 v2 Version: 0   < (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n
 Create a notification for this product.
   TP-Link Systems Inc. Archer MR200 v7 Version: 0   < (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n
 Create a notification for this product.
   TP-Link Systems Inc. TL-MR6400 v8.0 Version: 0   < (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n
 Create a notification for this product.
   TP-Link Systems Inc. TL-MR150 v3.20 Version: 0   < (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n
 Create a notification for this product.
   TP-Link Systems Inc. TL-MR100 v3.20 Version: 0   < (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n
Version: 0   < 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n,  Customized Software for South Korea KT
Version: 0   < 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12339",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T14:44:35.924185Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T14:44:53.124Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "TL-MR6400 v5.3",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Archer MR600 v2",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Archer MR200 v7",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TL-MR6400 v8.0",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TL-MR150 v3.20",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TL-MR100 v3.20",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, \u00a0Customized Software for South Korea KT",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "MrBruh"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "haehet"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.\u003cdiv\u003eSuccessful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability. \u003c/div\u003e"
            }
          ],
          "value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.Successful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-17",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-17 Using Malicious Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T23:31:52.397Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/en/support/faq/5237/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authenticated Arbitrary File Write Vulnerability in multiple devices",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2026-12339",
    "datePublished": "2026-08-10T18:20:50.576Z",
    "dateReserved": "2026-06-15T15:51:52.827Z",
    "dateUpdated": "2026-08-25T23:31:52.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}