CVE-2026-8619: Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600
An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process.
Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0, and Archer MR600 v2 devices. Exploitation requires the attacker to be on an adjacent network and able to reach the device's HTTP service.
Does an attacker need credentials or administrative access?
No. The vulnerability is unauthenticated, so an attacker does not need valid credentials to send the crafted HTTP request that triggers the HTTP service crash.
What is the expected impact of a successful attack?
A successful attack crashes the HTTP service process. This temporarily makes the web management interface and HTTP-dependent functionality unavailable.