CVE-2026-12339Authenticated Arbitrary File Write Vulnerability in multiple devices
Updated under an hour ago ()
Does this affect you?
It affects TP-Link Systems Inc. TL-MR6400 v5.3 and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.
- CVSS
- 6.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- TPLink
- NVD analysis
- Awaiting Analysis
- Record last updated
- Aug 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
TP-Link Systems Inc. TL-MR6400 v5.3 tp_link_systems:tl_mr6400_v5.3 (from the name) | before (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n | CNA record |
TP-Link Systems Inc. Archer MR600 v2 tp_link_systems:archer_mr600_v2 (from the name) | before (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n | CNA record |
TP-Link Systems Inc. Archer MR200 v7 tp_link_systems:archer_mr200_v7 (from the name) | before (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n | CNA record |
TP-Link Systems Inc. TL-MR6400 v8.0 tp_link_systems:tl_mr6400_v8.0 (from the name) | before (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n | CNA record |
TP-Link Systems Inc. TL-MR150 v3.20 tp_link_systems:tl_mr150_v3.20 (from the name) | before (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n | CNA record |
TP-Link Systems Inc. TL-MR100 v3.20 tp_link_systems:tl_mr100_v3.20 (from the name) | before (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n; before 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, Customized Software for South Korea KT; before 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor | CNA record |
References
- https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmwarepatch
- https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmwarepatch
- https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmwarepatch
- https://www.tp-link.com/en/support/faq/5237/vendor-advisory
- https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmwarepatch
- https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmwarepatch
- https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmwarepatch
- https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmwarepatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.