CVE-2026-76653: Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600
Published Sep 10, 2026
·Updated
A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials.
Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.
Affected Software
2 affected components
TP-Link TL-MR6400=v8
TP-Link Archer MR600>=v2<=v5
Event History
Sep 10, 2026
CVE Published
via MITRE·08:12 PM
Data Sourced
via MITRE·08:12 PM
DescriptionWeakness
Frequently Asked Questions
1
Which device revisions are identified as affected?
The affected revisions listed are Archer MR600 v2, v3, and v5, and TL-MR6400 v8.
2
Does exploitation require valid router credentials or prior access?
No. The issue may be exploited remotely by an unauthenticated attacker, without valid credentials.
3
What can an attacker do if exploitation succeeds?
An attacker may be able to disclose VPN configuration information and modify VPN configuration settings.