CVE-2026-17252: Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface
A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request.
Successful exploitation may cause the web service process to crash, resulting in a denial-of-service condition and temporary loss of access to the router's web management interface.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker adjacent to the affected router can trigger it. The issue is in the administrative web interface, so exposure depends on whether an attacker can reach that interface from an adjacent network.
What does an attacker need to send?
The attacker needs to send a specially crafted malformed HTTP request to the login request handling functionality. No authentication is required.
What is the expected impact of successful exploitation?
Successful exploitation can crash the web service process, causing a denial-of-service condition. This temporarily prevents access to the router's web management interface.