CVE-2026-76653
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials.
Risk Assessment
A remote unauthenticated attacker can disclose and modify VPN configuration, potentially compromising network security and intercepting traffic.
Recommendation
Apply firmware updates for affected devices as soon as possible and restrict access to the management interface from untrusted networks.
Other vulnerabilities in Archer MR600 and TL-MR6400
Original NVD description (English source)
A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS