Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-76653 EUVD-2026-75726GHSA-4rwx-9hrf-jj43

Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600

Published Sep 10, 2026 · Updated Sep 10, 2026 · Assigned by TPLink

Vendor: TP-Link Systems Product: Archer MR600 Product: TL-MR6400 v8 Category: Network devices

Description

A missing
authentication vulnerability in the VPN configuration management has been
identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker
may be able to access and modify VPN configuration information without valid
credentials.

Successful
exploitation may allow a remote unauthenticated attacker to disclose and modify
VPN configuration information.

Affected products

VendorProductAffectedFixed
TP-Link Systems TL-MR6400 v8 < 1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n 1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n
TP-Link Systems Archer MR600 v3 – < MR600(EU)_V3_1.4.0 Build 260827, v2 – < MR600(EU)_V2_1.12.0 Build 2600826 MR600(EU)_V3_1.4.0 Build 260827

References