Command Injection Vulnerability in Telnet CLI on TP-Link TL-MR6400
Key facts
- Attack vector
- Adjacent network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5.3. This issue is caused by insufficient sanitization of data processed during specific CLI operations. An authenticated attacker with elevated privileges may be able to execute arbitrary system commands. Successful exploitation may lead to full device compromise, including potential loss of confidentiality, integrity, and availability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TP-Link | TL-MR6400 v5.3 | before 1.9.0 Build 260108 | 1.9.0 Build 260108 | Patch available | CNA |
- TL-MR6400 v5.3 VendorTP-Link Affected before 1.9.0 Build 260108 Fixed in 1.9.0 Build 260108 Patch available CNA
Remediation
- Fix · CNA TL-MR6400 v5.3 (TP-Link Systems Inc.) Fixed in 1.9.0 Build 260108
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3841
- 2026-10-03 Alias added: GHSA-ppr5-j2r8-wqw5
References
More TP-Link Tl-mr6400 Firmware vulnerabilities
- TI-2026-07575 NULL pointer dereference in TP-Link TL-MR100 v3.2 CVSS 4.0HIGH 7.1
Sources
- CVE-2026-3841 · CVE Program
- CVE-2026-3841 · NVD
- FIRST EPSS
- GHSA-ppr5-j2r8-wqw5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences