A Zip Slip vulnerability in the WebUI ISP
Upgrade functionality allows arbitrary file write via a crafted archive
containing directory traversal sequences. An authenticated administrator may
overwrite arbitrary files on the system.Successful
exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00343.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
TP-Link Systems Inc. TL-MR6400 v5.3 unaffected
Version Status Constraints
0 affected < (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n
TP-Link Systems Inc. Archer MR600 v2 unaffected
Version Status Constraints
0 affected < (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n
TP-Link Systems Inc. Archer MR200 v7 unaffected
Version Status Constraints
0 affected < (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n
TP-Link Systems Inc. TL-MR6400 v8.0 unaffected
Version Status Constraints
0 affected < (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n
TP-Link Systems Inc. TL-MR150 v3.20 unaffected
Version Status Constraints
0 affected < (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n
TP-Link Systems Inc. TL-MR100 v3.20 unaffected
Version Status Constraints
0 affected < (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n
0 affected < 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n,  Customized Software for South Korea KT
0 affected < 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Tp-link Subscribe
Archer Mr200 V07 Subscribe
Archer Mr600 V2 Subscribe
Tl-mr6400 V5.3 Subscribe

Project Subscriptions

Vendors Products
Tp-link Subscribe
Archer Mr200 V07 Subscribe
Archer Mr600 V2 Subscribe
Tl-mr6400 V5.3 Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware cve-icon cve-icon
https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware cve-icon cve-icon
https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware cve-icon cve-icon
https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware cve-icon cve-icon
https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware cve-icon cve-icon
https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware cve-icon cve-icon
https://www.tp-link.com/en/support/faq/5237/ cve-icon cve-icon
https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware cve-icon cve-icon
History

Tue, 25 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Description A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on the underlying system, affecting system integrity and availability. A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

Tue, 25 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
References

Tue, 11 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Tp-link
Tp-link archer Mr200 V07
Tp-link archer Mr600 V2
Tp-link tl-mr6400 V5.3
Vendors & Products Tp-link
Tp-link archer Mr200 V07
Tp-link archer Mr600 V2
Tp-link tl-mr6400 V5.3

Tue, 11 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 10 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Description A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on the underlying system, affecting system integrity and availability.
Title Authenticated Arbitrary File Write Vulnerability in multiple devices
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published:

Updated: 2026-08-25T23:31:52.397Z

Reserved: 2026-06-15T15:51:52.827Z

Link: CVE-2026-12339

cve-icon Vulnrichment

Updated: 2026-08-11T14:44:42.664Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-10T19:17:28.500

Modified: 2026-08-26T05:18:05.410

Link: CVE-2026-12339

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T04:45:05Z

Weaknesses