CVE-2026-8619 TP-Link — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	7.1 (HIGH)
Affected Versions	before 1.5.0
Fixed In	1.3.0
Type	CWE-476 (NULL Pointer Dereference)
Vendor	TP-Link
Public PoC	No

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable.

Attack Parameters

Attack Vector

Adjacent

Requires local network access

Attack Complexity

Low

Easy to exploit

Attack Requirements

None

No additional conditions

Privileges Required

None

No privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

None

No data leak

Integrity

None

No data modification

Availability

High

Complete denial of service

CVSS Vector v4.0

Weakness Type (CWE)

CWE-476 NULL Pointer Dereference

Vulnerable Products 8

Configuration	From (including)	Up to (excluding)
Tp-Link Tl-Mr100_Firmware cpe:2.3:o:tp-link:tl-mr100_firmware::::::::	—	`1.3.0`
Tp-Link Tl-Mr100 cpe:2.3:h:tp-link:tl-mr100:3.2:::::::*	—	—
Tp-Link Archer_Mr600_Firmware cpe:2.3:o:tp-link:archer_mr600_firmware::::::::	—	`1.10.0`
Tp-Link Archer_Mr600 cpe:2.3:h:tp-link:archer_mr600:2.0:::::::*	—	—
Tp-Link Tl-Mr150_Firmware cpe:2.3:o:tp-link:tl-mr150_firmware::::::::	—	`1.3.0`
Tp-Link Tl-Mr150 cpe:2.3:h:tp-link:tl-mr150:3.2:::::::*	—	—
Tp-Link Tl-Mr6400_Firmware cpe:2.3:o:tp-link:tl-mr6400_firmware::::::::	—	`1.5.0`
Tp-Link Tl-Mr6400 cpe:2.3:h:tp-link:tl-mr6400:8.0:::::::*	—	—