EUVD-2026-75726
GHSA-4rwx-9hrf-jj43
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network vector per vendor CVSS 4.0; no authentication required; limited to VPN config read/write with no availability impact.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
2DescriptionCVE.org
A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials.
Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.
AnalysisAI
Missing authentication in VPN configuration management on TP-Link 4G LTE routers (Archer MR600 v2/v3/v5 and TL-MR6400 v8) permits an unauthenticated adjacent-network attacker to read and overwrite VPN credentials and tunnel configuration without any valid credentials. The vendor's CVSS 4.0 vector (AV:A) indicates the attack surface is adjacent-network rather than fully internet-routable, constraining exposure to attackers with local LAN, Wi-Fi, or cellular-segment access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must be on an adjacent network segment - the same LAN, Wi-Fi network, or potentially the same mobile carrier NAT - to reach the VPN configuration management endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.0 vector scores 5.3 with AV:A (adjacent network), PR:N, and limited CIA impact (VC:L/VI:L/VA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the latest vendor-released firmware for the affected hardware versions: TL-MR6400 v8 firmware is available at https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware and Archer MR600 v5 firmware at https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware; consult the vendor advisory at https://www.tp-link.com/us/support/faq/5292/ for version specifics. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tl Mr6400 V8
View allSame weakness CWE-126 – Buffer Over-read
View allShare
External POC / Exploit Code
Leaving vuln.today