CVE-2026-17252
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
TP-Link TL-MR6400 v7 router has a stack-based out-of-bounds write vulnerability in the login request handling of the administrative web interface. An unauthenticated adjacent attacker can send a specially crafted malformed HTTP request, causing the web service process to crash.
Risk Assessment
The attack can cause denial of service (DoS) and temporary loss of access to the router's web management interface.
Recommendation
Apply firmware updates from the vendor if available, or restrict access to the administrative interface.
Other vulnerabilities in TP-Link TL-MR6400
See all- CVE-2026-17251High
TP-Link TL-MR6400 v7 router has a NULL pointer dereference vulnerability in the HTTP request parsing functionality. An unauthenticated remote attacker can send a specially crafted HTTP request with a malformed session cookie header, causing the HTTP service process to crash.
- CVE-2026-17250High
TP-Link TL-MR6400 v7 router has a stack-based buffer overflow vulnerability in the firmware update functionality due to unsafe processing of attacker-controlled metadata within a firmware image. An authenticated attacker can exploit this to trigger memory corruption and execute arbitrary code.
Original NVD description (English source)
A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request. Successful exploitation may cause the web service process to crash, resulting in a denial-of-service condition and temporary loss of access to the router's web management interface.