CVE-2026-76653

Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600

Published Sep 10, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

A missing
authentication vulnerability in the VPN configuration management has been
identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker
may be able to access and modify VPN configuration information without valid
credentials.

Successful
exploitation may allow a remote unauthenticated attacker to disclose and modify
VPN configuration information.

Analysis

Technical impact

A missing authentication flaw in the VPN configuration management subsystem of TP‑Link routers allows a remote unauthenticated attacker to read and modify VPN configuration details. The vulnerability stems from improper access control, meaning that authentication is not required to perform configuration changes, which could lead to exposure or tampering of sensitive VPN settings.

Affected Systems

The flaw affects TP‑Link Systems Inc. Archer MR600 models (firmware versions v2, v3, and v5) and the TL‑MR6400 v8. All affected routers can reach the vulnerable configuration management endpoint remotely without credentials.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. However, the vulnerability is exploitable remotely by unauthenticated actors, security.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TP-Link Systems Inc.

TL-MR6400 v8

unaffected

Version	Status	Constraints
`0`	affected	< 1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n

TP-Link Systems Inc.

Archer MR600

unaffected

Version	Status	Constraints
`v3`	affected	< MR600(EU)_V3_1.4.0 Build 260827
`v2`	affected	< MR600(EU)_V2_1.12.0 Build 2600826

No data.

Vendor Product Versions

Tp-link

Archer Mr600

Version	Status	Scheme	Platform
`[v3,MR600(EU)_V3_1.4.0 Build 260827)`	affected	generic	['linux']
`[v2,MR600(EU)_V2_1.12.0 Build 2600826)`	affected	generic	['linux']

Tp-link

Tl-mr6400 V8

Version	Status	Scheme	Platform
`[0,1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n)`	affected	generic	['linux']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the access to VPN configuration management for Archer MR600 and TL‑MR6400 devices.
If an update is not immediately available, block or restrict access to the router’s configuration management interface from untrusted networks or disable the VPN configuration feature through a firewall or access control list.
Ensure that the router is properly segmented, and non‑essential management ports protected from potential attackers.

Generated by OpenCVE AI on September 10, 2026 at 22:54 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.474% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware
https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware
https://www.tp-link.com/us/support/faq/5292/

History

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Tp-link Tp-link archer Mr600 Tp-link tl-mr6400 V8
Vendors & Products		Tp-link Tp-link archer Mr600 Tp-link tl-mr6400 V8

Sep 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 10, 2026 8:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.
Title		Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600
Weaknesses		CWE-126
References		https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware https://www.tp-link.com/us/support/faq/5292/
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`