CVE-2026-12339

Authenticated Arbitrary File Write Vulnerability in multiple devices

MEDIUM

6.9

CVSS Score

Published: August 10, 2026 at 06:20 PM UTC

Updated: October 23, 2026 at 08:10 PM UTC

5 products affected across 1 vendorTL-MR6400Archer MR600Archer MR200

Using TL-MR6400 v5.3 by TP-Link Systems Inc.?

Get instant alerts when new vulnerabilities affect TL-MR6400 v5.3 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.9

Exploit prediction

EPSS 0.5%

SSVC

No known exploit

Description

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on the underlying system, affecting system integrity and availability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Archer MR600 · TP-Link

90%

0 ≤ v < (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n0

Affected range stops below (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n, so it looks safe — our inference, not a vendor statement

Archer MR200 · TP-Link

90%

0 ≤ v < (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n0

Affected range stops below (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n, so it looks safe — our inference, not a vendor statement

TL-MR6400 · TP-Link

90%

0 ≤ v < (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n0 ≤ v < (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n0

Affected range stops below (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n, so it looks safe — our inference, not a vendor statement

Affected range stops below (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n, so it looks safe — our inference, not a vendor statement

TL-MR100 · TP-Link

90%

0 ≤ v < (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n0 ≤ v < 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, Customized Software for South Korea KT0 ≤ v < 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor0

Affected range stops below (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, Customized Software for South Korea KT, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor, so it looks safe — our inference, not a vendor statement

TL-MR150 · TP-Link

90%

0 ≤ v < (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n0

Affected range stops below (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n, so it looks safe — our inference, not a vendor statement