Archer Mr600
Monthly
Authenticated path traversal in the file upload functionality of TP-Link Archer MR600 (v2, v3, v5) and TL-MR6400 v8 allows an admin-level remote attacker to write files outside the intended upload directory, potentially overwriting system files accessible to the affected service. The vendor explicitly states that arbitrary code execution has not been demonstrated, making this an integrity-limited vulnerability rather than a full RCE. Vendor-released firmware patches are available for both affected product lines. No public exploit has been identified at time of analysis.
Missing authentication in VPN configuration management on TP-Link 4G LTE routers (Archer MR600 v2/v3/v5 and TL-MR6400 v8) permits an unauthenticated adjacent-network attacker to read and overwrite VPN credentials and tunnel configuration without any valid credentials. The vendor's CVSS 4.0 vector (AV:A) indicates the attack surface is adjacent-network rather than fully internet-routable, constraining exposure to attackers with local LAN, Wi-Fi, or cellular-segment access. No public exploit has been identified at time of analysis; a vendor-released patch is available via firmware update.
Authenticated path traversal in the file upload functionality of TP-Link Archer MR600 (v2, v3, v5) and TL-MR6400 v8 allows an admin-level remote attacker to write files outside the intended upload directory, potentially overwriting system files accessible to the affected service. The vendor explicitly states that arbitrary code execution has not been demonstrated, making this an integrity-limited vulnerability rather than a full RCE. Vendor-released firmware patches are available for both affected product lines. No public exploit has been identified at time of analysis.
Missing authentication in VPN configuration management on TP-Link 4G LTE routers (Archer MR600 v2/v3/v5 and TL-MR6400 v8) permits an unauthenticated adjacent-network attacker to read and overwrite VPN credentials and tunnel configuration without any valid credentials. The vendor's CVSS 4.0 vector (AV:A) indicates the attack surface is adjacent-network rather than fully internet-routable, constraining exposure to attackers with local LAN, Wi-Fi, or cellular-segment access. No public exploit has been identified at time of analysis; a vendor-released patch is available via firmware update.