TP-Link Fixes Three High-Severity TL-MR6400 Router Flaws

TP-Link recently patched three high-severity TL-MR6400 router flaws in version 7 hardware. Specifically, these issues allow attackers to run arbitrary code or crash the device. Therefore, users must update their firmware immediately to prevent potential attacks.

Why These Vulnerabilities Matter

These vulnerabilities present a severe risk to network security. Furthermore, attackers can gain full control over affected routers. They can also knock the device offline completely. Consequently, this disrupts internet access and potentially compromises connected devices. Fortunately, experts have not confirmed any active exploitation in the wild.

How the Attacks Work

CVE-2026-17250

Looking at the details, CVE-2026-17250 is a stack-based buffer overflow. An authenticated user uploads a firmware image containing malicious metadata. The router mishandles this data, triggering memory corruption and code execution.

CVE-2026-17251

Meanwhile, CVE-2026-17251 involves a null pointer dereference. An unauthenticated attacker sends an HTTP request with a malformed session cookie. As a result, this action crashes the HTTP service instantly.

CVE-2026-17252

Lastly, CVE-2026-17252 is an out-of-bounds write vulnerability. An adjacent attacker sends a malformed HTTP request to the login interface. This crashes the web management service.

Affected Versions and Mitigation Steps

Notably, these issues impact TP-Link TL-MR6400 routers running hardware version 7. The exact number of affected devices currently remains unknown. To resolve this, TP-Link released a fix for these TL-MR6400 router flaws. Users should install firmware version 1.9.0 Build 260714 immediately. Administrators must prioritize this patch to maintain network integrity.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.