# CVE-2026-17250: TP-Link TL-MR6400 stack buffer overflow in firmware update

Source: https://junglewise.ai/threats/cve-2026-17250-tp-link-tl-mr6400-stack-buffer-overflow-in-firmware-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-17250 · Severity: info · Published 2026-08-21

The TL-MR6400 is a 4G LTE router used by businesses and consumers to provide wireless internet connectivity. A stack-based buffer overflow in its firmware update mechanism could allow an authenticated attacker with access to the device to execute arbitrary code and take complete control of the router, potentially compromising all traffic passing through it or launching further attacks on connected networks.

Technologies: [TP-Link TL-MR6400](https://junglewise.ai/threats/technologies/tl-mr6400). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-17250 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17250 being exploited in the wild.

**How severe is CVE-2026-17250?** Informational severity, published 21 August 2026.

**Which products and versions are affected?** TP-Link TL-MR6400 v7.

**Is there a fix for CVE-2026-17250?** A patch was published on 2026-08-19: Firmware build 260714 (APAC) v7_1.3.0 released with security improvements Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17250 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-17250?** Check whether you run TP-Link TL-MR6400 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack-based buffer overflow in the firmware update functionality of TL-MR6400 v7, caused by unsafe processing of attacker-controlled metadata within firmware images. An authenticated attacker can craft a malicious firmware image with oversized metadata fields to trigger memory corruption during the update process. Successful exploitation results in arbitrary code execution on the affected device with the privileges of the firmware update process. The attack requires the attacker to have authentication credentials to initiate the firmware update, and a patch has been released (build 260714 as of 2026-08-19) that improves security.

## Affected products

- TP-Link TL-MR6400 v7

## Timeline

- 2026-08-21: disclosed
- 2026-08-19: patched: Firmware build 260714 (APAC) v7_1.3.0 released with security improvements

## References

- [https://www.tp-link.com/en/support/download/tl-mr6400/v7/](https://www.tp-link.com/en/support/download/tl-mr6400/v7/)
- [https://www.tp-link.com/tw/support/download/tl-mr6400/v7/](https://www.tp-link.com/tw/support/download/tl-mr6400/v7/)

## Related threats

- [TP-Link Archer MR600 and TL-MR6400 authentication bypass in VPN configuration](https://junglewise.ai/threats/cve-2026-76653-tp-link-archer-mr600-and-tl-mr6400-authentication-bypass-in-vpn)
- [TP-Link Archer MR600 and TL-MR6400 directory traversal in file upload](https://junglewise.ai/threats/cve-2026-76652-tp-link-archer-mr600-and-tl-mr6400-directory-traversal-in-file)
- [TP-Link TL-MR6400 v7 stack-based buffer overflow in login handler](https://junglewise.ai/threats/cve-2026-17252-tp-link-tl-mr6400-v7-stack-based-buffer-overflow-in-login-handler)
- [TP-Link TL-MR6400 NULL pointer dereference in HTTP parsing](https://junglewise.ai/threats/cve-2026-17251-tp-link-tl-mr6400-null-pointer-dereference-in-http-parsing)
- [TP-Link 4G/LTE router denial of service via malformed HTTP request](https://junglewise.ai/threats/cve-2026-8619-tp-link-4g-lte-router-denial-of-service-via-malformed-http-request)