Medium 6.9Published Aug 10, 2026

CVE-2026-12339Authenticated Arbitrary File Write Vulnerability in multiple devices

Updated under an hour ago (Oct 27, 2026, 7:23 AM ET)

Does this affect you?

It affects TP-Link Systems Inc. TL-MR6400 v5.3 and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for TP-Link Systems Inc. TL-MR6400 v5.3

Exploited in the last 30 days

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

CVSS: 6.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: TPLink
NVD analysis: Awaiting Analysis
Record last updated: Aug 25, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

TP-Link Systems Inc. TL-MR6400 v5.3 tp_link_systems:tl_mr6400_v5.3 (from the name)	before (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n	CNA record
TP-Link Systems Inc. Archer MR600 v2 tp_link_systems:archer_mr600_v2 (from the name)	before (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n	CNA record
TP-Link Systems Inc. Archer MR200 v7 tp_link_systems:archer_mr200_v7 (from the name)	before (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n	CNA record
TP-Link Systems Inc. TL-MR6400 v8.0 tp_link_systems:tl_mr6400_v8.0 (from the name)	before (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n	CNA record
TP-Link Systems Inc. TL-MR150 v3.20 tp_link_systems:tl_mr150_v3.20 (from the name)	before (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n	CNA record
TP-Link Systems Inc. TL-MR100 v3.20 tp_link_systems:tl_mr100_v3.20 (from the name)	before (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n; before 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, Customized Software for South Korea KT; before 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor	CNA record

References

References

https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware	patch
https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware	patch
https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware	patch
https://www.tp-link.com/en/support/faq/5237/	vendor-advisory
https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware	patch
https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware	patch
https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware	patch
https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.