Archer Mr600 Firmware
Monthly
Unauthenticated denial-of-service in TP-Link TL-MR100, TL-MR150, TL-MR6400, and Archer MR600 routers allows an adjacent-network attacker to crash the HTTP management service by sending a specially crafted HTTP request that triggers a NULL pointer dereference (CWE-476). Exploitation requires only network adjacency and no credentials, resulting in the web management interface and any HTTP-dependent functionality becoming temporarily unavailable until the service restarts. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low attack complexity makes this straightforward to trigger for any attacker already on the local or adjacent network.
Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console, possibly leading to service disruption or full compromise. [CVSS 8.8 HIGH]
Unauthenticated denial-of-service in TP-Link TL-MR100, TL-MR150, TL-MR6400, and Archer MR600 routers allows an adjacent-network attacker to crash the HTTP management service by sending a specially crafted HTTP request that triggers a NULL pointer dereference (CWE-476). Exploitation requires only network adjacency and no credentials, resulting in the web management interface and any HTTP-dependent functionality becoming temporarily unavailable until the service restarts. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low attack complexity makes this straightforward to trigger for any attacker already on the local or adjacent network.
Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console, possibly leading to service disruption or full compromise. [CVSS 8.8 HIGH]