CVE-2026-17250: Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling
Published Aug 21, 2026
·Updated
A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image.
Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary code on the affected device.
Affected Software
1 affected component
TP-Link TL-MR6400=7
Event History
Aug 21, 2026
CVE Published
via MITRE·05:16 PM
Data Sourced
via MITRE·05:16 PM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be authenticated to the affected device and able to submit a crafted firmware image containing attacker-controlled metadata.
2
What is the likely impact of successful exploitation?
Successful exploitation can corrupt memory through a stack-based buffer overflow and may allow arbitrary code execution on the affected device.
3
Which device version is identified as affected?
The affected product identified is TP-Link TL-MR6400 v7.