Read the docs
TI-2026-07575 Aliases CVE-2026-8619GHSA-vp4h-929p-f8gq

NULL pointer dereference in TP-Link TL-MR100 v3.2

Priority LOW 33CWE-476Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference.  A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00874 59th percentileScored 2026-11-07
Fix Fixed TL-MR100 v3.2 (TP-Link Systems Inc.): TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957nTL-MR150 v.3.2 (TP-Link Systems Inc.): TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTL-MR100 v3.2before TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957nTL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957nPatch availableCNA
TP-LinkTL-MR150 v.3.2before TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727nTL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727nPatch availableCNA
TP-LinkTL-MR6400 v8.0before TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978nTL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978nPatch availableCNA
TP-LinkArcher MR600 v2before Archer MR600(EU)_V2_1.10.0 Build 260618Archer MR600(EU)_V2_1.10.0 Build 260618Patch availableCNA
  • TL-MR100 v3.2 VendorTP-Link Affected before TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957n Fixed in TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957n Patch available CNA
  • TL-MR150 v.3.2 VendorTP-Link Affected before TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n Fixed in TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n Patch available CNA
  • TL-MR6400 v8.0 VendorTP-Link Affected before TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978n Fixed in TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978n Patch available CNA
  • Archer MR600 v2 VendorTP-Link Affected before Archer MR600(EU)_V2_1.10.0 Build 260618 Fixed in Archer MR600(EU)_V2_1.10.0 Build 260618 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tl-mr100_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableTP-Link
cpe:2.3:h:tp-link:tl-mr100:3.2:*:*:*:*:*:*:*3.2Running onTP-Link
cpe:2.3:o:tp-link:archer_mr600_firmware:*:*:*:*:*:*:*:*before 1.10.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_mr600:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:tl-mr150_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableTP-Link
cpe:2.3:h:tp-link:tl-mr150:3.2:*:*:*:*:*:*:*3.2Running onTP-Link
cpe:2.3:o:tp-link:tl-mr6400_firmware:*:*:*:*:*:*:*:*before 1.5.0VulnerableTP-Link
cpe:2.3:h:tp-link:tl-mr6400:8.0:*:*:*:*:*:*:*8.0Running onTP-Link
  • cpe:2.3:o:tp-link:tl-mr100_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tl-mr100:3.2:*:*:*:*:*:*:* Versions 3.2 Running on ·TP-Link
  • cpe:2.3:o:tp-link:archer_mr600_firmware:*:*:*:*:*:*:*:* Versions before 1.10.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_mr600:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:tl-mr150_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tl-mr150:3.2:*:*:*:*:*:*:* Versions 3.2 Running on ·TP-Link
  • cpe:2.3:o:tp-link:tl-mr6400_firmware:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tl-mr6400:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·TP-Link

Remediation

  • Fix · CNA TL-MR100 v3.2 (TP-Link Systems Inc.) Fixed in TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957n
  • Fix · CNA TL-MR150 v.3.2 (TP-Link Systems Inc.) Fixed in TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n
  • Fix · CNA TL-MR6400 v8.0 (TP-Link Systems Inc.) Fixed in TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978n
  • Fix · CNA Archer MR600 v2 (TP-Link Systems Inc) Fixed in Archer MR600(EU)_V2_1.10.0 Build 260618

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8619
  2. 2026-10-03 Alias added: GHSA-vp4h-929p-f8gq

References

Patch 4

Advisory 1

  • TI-2025-13472 Authenticated Command Injection Vulnerability in Archer MR600 CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences