TP-Link LTE Routers CVE-2026-8619

Exploitation requires the attacker to be on an adjacent network to the target router, meaning the same Layer 2 broadcast domain, local LAN segment, or in some deployment models the upstream ISP link - this is not exploitable from the general internet unless the router's HTTP management port is explicitly forwarded externally (non-default and generally inadvisable). No authentication is required (PR:N confirmed by CVSS vector). No user interaction is needed. The attack targets the default HTTP management interface, which is enabled by default on these devices when accessed from the LAN side. What limits exploitation: the adjacency requirement (AV:A) prevents mass internet-scale exploitation; the impact is limited to a temporary service crash with no data exfiltration or device takeover; the HTTP service typically recovers on restart, so the disruption is transient. Devices with HTTP management disabled or restricted to specific trusted IPs via ACL would reduce exposure.

The CVSS 4.0 score of 7.1 accurately reflects a meaningful but bounded risk. The adjacency requirement (AV:A) is the most significant limiting factor: an attacker must already be on the local network, the same broadcast domain, or the upstream ISP link - this is not a remote internet-scale threat. There is no confidentiality or integrity impact (VC:N/VI:N), and the availability impact (VA:H) is temporary, as the HTTP service will typically restart automatically or after a device reboot. EPSS data was not provided, but given the adjacency constraint and DoS-only impact, real-world exploitation probability against any given device is low. No KEV listing and no public exploit code further reduce the operational threat level. The primary realistic threat actors are insiders, compromised LAN devices, or attackers who have already gained network adjacency through other means. This should be treated as a medium-priority firmware update rather than an emergency response item, unless the routers are deployed in environments with untrusted adjacent clients.

An attacker already present on the same local network as the router - for example, a guest Wi-Fi client, a compromised IoT device, or an ISP-side adversary with L2 adjacency - sends a single specially crafted HTTP request to the router's management port. The malformed request triggers a NULL pointer dereference in the HTTP processing thread, causing the service to crash and rendering the web management interface inaccessible to legitimate administrators until the service recovers. No authentication or prior access is required beyond network adjacency.