CVE-2026-8619
High
Description
An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Tp-link Tl-mr100 Firmware
PublishedAug 20, 2026
First seenAug 20, 2026
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- tp-link tl-mr100_firmware1.3.0 or later
- tp-link archer_mr600_firmware1.10.0 or later
- tp-link tl-mr150_firmware1.3.0 or later
- tp-link tl-mr6400_firmware1.5.0 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tp-link tl-mr100_firmware | v < 1.3.0 | 1.3.0 |
| tp-link archer_mr600_firmware | v < 1.10.0 | 1.10.0 |
| tp-link tl-mr150_firmware | v < 1.3.0 | 1.3.0 |
| tp-link tl-mr6400_firmware | v < 1.5.0 | 1.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.