Is there a patch available for CVE-2026-12339?

Yes, a patch is available for CVE-2026-12339. Update the affected software to the latest version immediately.

TP-Link Routers CVE-2026-12339

Q: What is the CVSS score of CVE-2026-12339?

CVE-2026-12339 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-55700 MEDIUM

Path Traversal (CWE-22)

2026-08-10 TPLink

GHSA-www9-662g-pffv

Path Traversal Tl Mr6400 V5 3 Archer Mr600 V2 Archer Mr200 V7 Tp Link Systems Inc

6.9

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.2 MEDIUM

Adjacent vector matches CVSS 4.0 AV:A; PR:H reflects mandatory admin authentication; integrity is high (arbitrary file write), availability low (potential disruption), confidentiality none.

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 19:32 vuln.today

DescriptionCVE.org

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on the underlying system, affecting system integrity and availability.

AnalysisAI

Arbitrary file write via Zip Slip path traversal in TP-Link's WebUI ISP Upgrade functionality affects three LTE router models - TL-MR6400 v5.3, Archer MR600 v2, and Archer MR200 v7. An authenticated administrator on the adjacent network can upload a crafted archive containing directory traversal sequences (e.g., '../../') to overwrite arbitrary files on the underlying system, compromising integrity and potentially availability. No public exploit code or CISA KEV listing has been identified; vendor-released patches are available as of mid-2026.

Technical ContextAI

CWE-22 (Path Traversal) manifests here as a classic Zip Slip variant: when the WebUI ISP Upgrade feature extracts a firmware or ISP configuration archive, it fails to sanitize file entry paths before writing to disk, allowing entries like '../../etc/passwd' to land outside the intended extraction directory. The affected CPEs (cpe:2.3:a:tp-link_systems_inc.:tl-mr6400_v5.3, archer_mr600_v2, archer_mr200_v7) are TP-Link 4G/LTE mobile broadband routers running embedded Linux. The vulnerability resides in the archive-extraction logic of the web management interface, a component shared across multiple router variants. The CVSS 4.0 vector (AV:A) confirms that exploitation requires adjacency to the router's management network - typically the LAN or local Wi-Fi segment.

RemediationAI

Apply the vendor-released firmware patches immediately. For TL-MR6400 v5.3, upgrade to firmware Build 260613 RC.76099n or later via https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware. For Archer MR600 v2, upgrade to firmware Build 260618 RC.40417n or later via https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware. For Archer MR200 v7, upgrade to firmware Build 260605 Rel.57870n or later via https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware. Full advisory is available at https://www.tp-link.com/en/support/faq/5237/. As a compensating control where immediate patching is not possible, restrict administrative access to the WebUI to a dedicated management VLAN and remove administrative privileges from all non-essential accounts - this directly addresses the PR:H prerequisite. Disabling the ISP Upgrade functionality in the WebUI, if the router interface permits it, would eliminate the vulnerable code path entirely with no impact on normal routing operation.