CVE-2026-12339

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Aug 10, 2026
Source updated: Aug 25, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Authenticated Arbitrary File Write Vulnerability in multiple devices

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

TL-MR6400 v5.3

Vendor: TP-Link Systems Inc.
Product: TL-MR6400 v5.3
Platforms: Unknown
Default status: unaffected

TL-MR6400 v5.3 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	(EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n	Unavailable	None listed

Archer MR600 v2

Vendor: TP-Link Systems Inc.
Product: Archer MR600 v2
Platforms: Unknown
Default status: unaffected

Archer MR600 v2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	(EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n	Unavailable	None listed

Archer MR200 v7

Vendor: TP-Link Systems Inc.
Product: Archer MR200 v7
Platforms: Unknown
Default status: unaffected

Archer MR200 v7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	(EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n	Unavailable	None listed

TL-MR6400 v8.0

Vendor: TP-Link Systems Inc.
Product: TL-MR6400 v8.0
Platforms: Unknown
Default status: unaffected

TL-MR6400 v8.0 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	(EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n	Unavailable	None listed

TL-MR150 v3.20

Vendor: TP-Link Systems Inc.
Product: TL-MR150 v3.20
Platforms: Unknown
Default status: unaffected

TL-MR150 v3.20 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	(EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n	Unavailable	None listed

TL-MR100 v3.20

Vendor: TP-Link Systems Inc.
Product: TL-MR100 v3.20
Platforms: Unknown
Default status: unaffected

TL-MR100 v3.20 · Scoped product and version facts
Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
`affected`	custom	(EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n	Unavailable	None listed
`affected`	custom	1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, Customized Software for South Korea KT	Unavailable	None listed
`affected`	custom	1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor	Unavailable	None listed