CVE-2026-76653
Medium
Description
A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.
SeverityMedium
CVSS5.3
Exploit probability—
ProductTL-MR6400 v8
PublishedSep 10, 2026
First seenSep 10, 2026
Weakness typeCWE-126CWE-126
How to fix
Update
- TP-Link Systems Inc. TL-MR6400 v81.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n or later
- TP-Link Systems Inc. Archer MR600MR600(EU)_V3_1.4.0 Build 260827, MR600(EU)_V2_1.12.0 Build 2600826 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TP-Link Systems Inc. TL-MR6400 v8 | v < 1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n | 1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n |
| TP-Link Systems Inc. Archer MR600 | v3 ≤ v < MR600(EU)_V3_1.4.0 Build 260827, v2 ≤ v < MR600(EU)_V2_1.12.0 Build 2600826 | MR600(EU)_V3_1.4.0 Build 260827, MR600(EU)_V2_1.12.0 Build 2600826 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.