# CVE-2026-17252: TP-Link TL-MR6400 v7 stack-based buffer overflow in login handler

Source: https://junglewise.ai/threats/cve-2026-17252-tp-link-tl-mr6400-v7-stack-based-buffer-overflow-in-login-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-17252 · Severity: info · CVSS 6.5 · Published 2026-08-21

The TP-Link TL-MR6400 v7 is a 4G LTE router used by businesses and consumers to provide wireless internet connectivity. A vulnerability in its web management interface can be exploited by an attacker on the same network to crash the router's web service, temporarily preventing administrators from accessing or managing the device remotely.

Technologies: [TP-Link TL-MR6400](https://junglewise.ai/threats/technologies/tl-mr6400). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-17252 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17252 being exploited in the wild.

**How severe is CVE-2026-17252?** Informational severity, with a CVSS score of 6.5, published 21 August 2026.

**Which products and versions are affected?** TP-Link TL-MR6400 v7 (prior to firmware 1.3.0 Build 260714).

**Is there a fix for CVE-2026-17252?** A patch was published on 2026-08-19: Firmware version 1.3.0 Build 260714 released with security improvements Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17252 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-17252?** Check whether you run TP-Link TL-MR6400 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based out-of-bounds write vulnerability exists in the login request handling of the TL-MR6400 v7 administrative web interface. An unauthenticated attacker on the adjacent network can send a specially crafted malformed HTTP request to trigger the vulnerability without requiring valid credentials. Successful exploitation causes the web service process to crash, resulting in a denial-of-service condition that temporarily disables web-based management access. A patch was released in firmware version 1.3.0 Build 260714 published on 2026-08-19, which notes "improved security" as a fix.

## Affected products

- TP-Link TL-MR6400 v7 (prior to firmware 1.3.0 Build 260714)

## Timeline

- 2026-08-21: disclosed
- 2026-08-19: patched: Firmware version 1.3.0 Build 260714 released with security improvements

## References

- [https://www.tp-link.com/en/support/download/tl-mr6400/v7/](https://www.tp-link.com/en/support/download/tl-mr6400/v7/)
- [https://www.tp-link.com/tw/support/download/tl-mr6400/v7/](https://www.tp-link.com/tw/support/download/tl-mr6400/v7/)

## Related threats

- [TP-Link Archer MR600 and TL-MR6400 authentication bypass in VPN configuration](https://junglewise.ai/threats/cve-2026-76653-tp-link-archer-mr600-and-tl-mr6400-authentication-bypass-in-vpn)
- [TP-Link Archer MR600 and TL-MR6400 directory traversal in file upload](https://junglewise.ai/threats/cve-2026-76652-tp-link-archer-mr600-and-tl-mr6400-directory-traversal-in-file)
- [TP-Link TL-MR6400 NULL pointer dereference in HTTP parsing](https://junglewise.ai/threats/cve-2026-17251-tp-link-tl-mr6400-null-pointer-dereference-in-http-parsing)
- [TP-Link TL-MR6400 stack buffer overflow in firmware update](https://junglewise.ai/threats/cve-2026-17250-tp-link-tl-mr6400-stack-buffer-overflow-in-firmware-update)
- [TP-Link 4G/LTE router denial of service via malformed HTTP request](https://junglewise.ai/threats/cve-2026-8619-tp-link-4g-lte-router-denial-of-service-via-malformed-http-request)