TP-Link TL-MR6400 CVE-2026-17251

Exploitation requires the attacker to be on the adjacent network (AV:A) - the same LAN segment or a network from which the router's HTTP management interface (typically port 80 or 443) is directly reachable. No authentication is required (PR:N per CVSS 4.0 vector) and no user interaction is needed. The critical limiting factor is the adjacent-network constraint: exploitation from the internet is not possible unless the router's management interface has been explicitly exposed to the WAN, which is a non-default configuration on consumer devices. The vulnerability is specific to the TL-MR6400 v7 hardware revision; other revisions are not confirmed affected. The attack surface is further limited to the HTTP management daemon - exploitation does not affect data-plane forwarding.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 7.1) accurately captures the key constraints: the attack is limited to the adjacent network (AV:A), meaning internet-based exploitation is not possible unless management is explicitly exposed to the WAN - a non-default configuration. Attack complexity is low and no privileges are required, but the adjacency requirement meaningfully restricts the attacker pool to those with LAN-level access. Impact is purely an availability denial against the management interface (VA:H), with no confidentiality or integrity consequences and no subsequent-system impact. No EPSS score was provided, and the CVE is absent from the CISA KEV catalog, consistent with no confirmed active exploitation. The real-world priority is moderate for environments relying on continuous router management access (e.g., managed ISP deployments), but low for typical consumer installations where brief management unavailability is tolerable and a patch is available.

An attacker connected to the same LAN segment as the TL-MR6400 v7 sends a single malformed HTTP request with a crafted session cookie header to the router's management interface. The embedded HTTP daemon dereferences a null pointer while parsing the malformed cookie, causing the process to crash and rendering the web management console and all CGI endpoints unavailable until the service restarts or the device reboots. No authentication, no user interaction, and no prior foothold on the device are required.