← Vulnerability feed

Vulnerability record · CVE-2026-8619 · published 20 August 2026

CVE-2026-8619: Tp-link tl-mr100 firmware null pointer dereference vulnerability

Tp Link · Tl Mr100 Firmware

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference.  A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable.

7.1 CVSS 4.0 High EPSS 0.87% · top 42.7% CWE-476 · NULL pointer dereference
7.1CVSS 4.0 base score
0.87%EPSS exploitation probability, 30 days
NoNot in CISA KEV
4Affected product versions listed by NVD
5References
3 Sep 2026Last modified by NVD

Description

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference.  A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable.

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware Product
https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware Product
https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware Product
https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware Product
https://www.tp-link.com/us/support/faq/5253/ Vendor Advisory

Track CVE-2026-8619 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.5CVE-2026-3841Tp-link tl-mr6400 firmware os command injection vulnerabilityA command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5.3. This issue is caused by i…EPSS 2.7%8.5CVE-2025-14756Tp-link archer mr600 firmware command injection vulnerabilityCommand injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to e…EPSS 2.8%6.2CVE-2026-21525Windows Remote Access Connection Manager null pointer dereference DoSWindows Remote Access Connection Manager contains a null pointer dereference (CWE-476) that lets an unauthorized attacker deny service locally. The f…KEVEPSS 4.8%analysed

Source: NIST National Vulnerability Database (record CVE-2026-8619), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.