Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-12339

Authenticated Arbitrary File Write Vulnerability in multiple devices

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TPLink

Description

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TP-Link Systems Inc. TL-MR6400 v5.3

Default version status: unaffected

  • 0 to < (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099naffected

TP-Link Systems Inc. Archer MR600 v2

Default version status: unaffected

  • 0 to < (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417naffected

TP-Link Systems Inc. Archer MR200 v7

Default version status: unaffected

  • 0 to < (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870naffected

TP-Link Systems Inc. TL-MR6400 v8.0

Default version status: unaffected

  • 0 to < (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978naffected

TP-Link Systems Inc. TL-MR150 v3.20

Default version status: unaffected

  • 0 to < (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727naffected

TP-Link Systems Inc. TL-MR100 v3.20

Default version status: unaffected

  • 0 to < (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957naffected
  • 0 to < 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n,  Customized Software for South Korea KTaffected
  • 0 to < 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenoraffected

References