Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-76653

Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TPLink

Description

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TP-Link Systems Inc. TL-MR6400 v8

Default version status: unaffected

  • 0 to < 1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978naffected

TP-Link Systems Inc. Archer MR600

Default version status: unaffected

  • v3 to < MR600(EU)_V3_1.4.0 Build 260827affected
  • v2 to < MR600(EU)_V2_1.12.0 Build 2600826affected

References