CVE-2026-12339
TP-Link · published 2026-08-10
Source record Collected from the National Vulnerability Database (NVD)
Description
Description by TPLink via the CVE Program.
A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.
Status at the source
- NVD status: Awaiting Analysis — NVD has not analysed this CVE.
Affected products, as the source lists them
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | TL-MR6400 v5.3 | 0 – before (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n: affected |
| TP-Link Systems Inc. | Archer MR600 v2 | 0 – before (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n: affected |
| TP-Link Systems Inc. | Archer MR200 v7 | 0 – before (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n: affected |
| TP-Link Systems Inc. | TL-MR6400 v8.0 | 0 – before (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n: affected |
| TP-Link Systems Inc. | TL-MR150 v3.20 | 0 – before (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n: affected |
| TP-Link Systems Inc. | TL-MR100 v3.20 | 0 – before (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n: affected 0 – before 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, Customized Software for South Korea KT: affected 0 – before 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor: affected |
DeSpy has not checked any unit, hardware revision or firmware. A product missing here is not a statement that it is unaffected.
Scores, as their sources published them
- CVSS 4.0: 6.9 MEDIUM — as published by TPLink (Secondary)
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - SSVC — CISA's assessment (SSVC 2.0.3, CISA Coordinator): Exploitation: none · Automatable: no · Technical impact: partial
DeSpy does not score records. These are the sources' own values.
Weaknesses
Sources
References the source lists
- https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware
- https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware
- https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware
- https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware
- https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware
- https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware
- https://www.tp-link.com/en/support/faq/5237/
- https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware
Source dates: published 2026-08-10, last changed 2026-08-26. DeSpy's copy of this version is dated 2026-09-28.
This product uses the NVD API but is not endorsed or certified by the NVD.
CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
CISA's Known Exploited Vulnerabilities catalog and CISA Vulnrichment data are CC0 1.0. CISA advisories are shown with the TLP label their document carries. No endorsement by CISA, DHS, NIST or MITRE is stated or implied.