CVE-2026-76653mediumCWE-126

CVE-2026-76653: medium-severity vulnerability in TP-Link Systems Inc. Archer MR600

Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600

Published

Follow this CVE+ Monitor TL-MR6400+ Monitor Archer MR600

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.5%
A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
TP-Link Systems Inc. · Archer MR600TP-Link Systems Inc. · TL-MR6400 v8
Related CVEs — TP-Link Systems Inc. Archer MR600

In the same product, most dangerous first.

CVE-2026-76652MEDIUMAuthenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL-MR6400 and Archer MR600EPSS 0.7%