# CVE-2026-17251: TP-Link TL-MR6400 NULL pointer dereference in HTTP parsing

Source: https://junglewise.ai/threats/cve-2026-17251-tp-link-tl-mr6400-null-pointer-dereference-in-http-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-17251 · Severity: info · CVSS 5.3 · Published 2026-08-21

The TL-MR6400 is a 4G LTE router used by small businesses and remote locations to provide internet connectivity. A flaw in its web administration interface can be triggered remotely without authentication, causing the HTTP service to crash and temporarily disrupting access to the router's management and control functions until it restarts.

Technologies: [TP-Link TL-MR6400](https://junglewise.ai/threats/technologies/tl-mr6400). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-17251 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17251 being exploited in the wild.

**How severe is CVE-2026-17251?** Informational severity, with a CVSS score of 5.3, published 21 August 2026.

**Which products and versions are affected?** TP-Link TL-MR6400 v7.

**Is there a fix for CVE-2026-17251?** A patch was published on 2026-08-19: Firmware build 260714 released with security improvements Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17251 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-17251?** Check whether you run TP-Link TL-MR6400 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. The vulnerability can be triggered by an unauthenticated remote attacker sending a specially crafted HTTP request with a malformed session cookie header. The flaw causes a crash of the HTTP service process, leading to a denial-of-service condition. The vulnerability is network-reachable and requires no prior authentication or user interaction. Exploitation results in temporary unavailability of management and CGI services until the router process recovers.

## Affected products

- TP-Link TL-MR6400 v7

## Timeline

- 2026-08-21: disclosed
- 2026-08-19: patched: Firmware build 260714 released with security improvements

## References

- [https://www.tp-link.com/en/support/download/tl-mr6400/v7/](https://www.tp-link.com/en/support/download/tl-mr6400/v7/)
- [https://www.tp-link.com/tw/support/download/tl-mr6400/v7/](https://www.tp-link.com/tw/support/download/tl-mr6400/v7/)

## Related threats

- [TP-Link Archer MR600 and TL-MR6400 authentication bypass in VPN configuration](https://junglewise.ai/threats/cve-2026-76653-tp-link-archer-mr600-and-tl-mr6400-authentication-bypass-in-vpn)
- [TP-Link Archer MR600 and TL-MR6400 directory traversal in file upload](https://junglewise.ai/threats/cve-2026-76652-tp-link-archer-mr600-and-tl-mr6400-directory-traversal-in-file)
- [TP-Link TL-MR6400 v7 stack-based buffer overflow in login handler](https://junglewise.ai/threats/cve-2026-17252-tp-link-tl-mr6400-v7-stack-based-buffer-overflow-in-login-handler)
- [TP-Link TL-MR6400 stack buffer overflow in firmware update](https://junglewise.ai/threats/cve-2026-17250-tp-link-tl-mr6400-stack-buffer-overflow-in-firmware-update)
- [TP-Link 4G/LTE router denial of service via malformed HTTP request](https://junglewise.ai/threats/cve-2026-8619-tp-link-4g-lte-router-denial-of-service-via-malformed-http-request)