Security Advisory: Multiple Vulnerabilities in TL-MR6400 (CVE-2026-17250, CVE-2026-17251 & CVE-2026-17252)

Description of Vulnerabilities and Impacts:

Multiple vulnerabilities have been identified in TL-MR6400 v7.

CVE-2026-17250 Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling

A stack-based buffer overflow vulnerability exists in the firmware update functionality of the affected product due to unsafe processing of attacker-controlled metadata within a firmware image.

Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary code on the affected device.

CVSS v4.0 Score: 8.5/ High

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-17251 Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of the affected product. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header.

Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of management or CGI functionality until service recovery.

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TL-MR6400 LTE routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request.

Successful exploitation may cause the web service process to crash, resulting in a denial-of-service condition and temporary loss of access to the router's web management interface.

Both CVE-2026-17251 and CVE-2026-17252 share the same CVSS scores:

CVSS v4.0 Score: 7.1/ High

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendations:

We strongly recommend that users with affected devices take the following actions:

1. Follow the instructions to update to the latest firmware version to fix the vulnerabilities:

EN: Download for TL-MR6400 | TP-Link

TW: 下載 TL-MR6400 | TP-Link 台灣地區

Note: Tl-MR6400 is not sold in the US.

Disclaimer:

This advisory is provided for informational purposes only and is subject to change without notice. The information is provided “as is” without warranties of any kind. TP-Link recommends that customers promptly apply available firmware updates or implement documented workarounds as provided in this advisory. Devices/systems that are not updated or mitigated as described may remain vulnerable, and TP-Link disclaims any responsibility or liability for any damages or losses arising from a failure to implement such updates.