CVE-2026-76653

Received Received - Intake

Missing Authentication in TP-Link Archer MR600 and TL-MR6400 VPN Configuration

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: TPLink

Description

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-76653

Affected Vendors & Products

Vendor	Product	Version / Range
archer	mr600	From 2\|end_excluding=6 (inc)
tp-link	tl-mr6400	8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-126	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authentication issue in VPN configuration management for Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 devices. It occurs due to improper access control, allowing remote unauthenticated attackers to access and modify VPN configuration information without valid credentials.

Detection Guidance

This vulnerability involves missing authentication in VPN configuration management for Archer MR600 and TL-MR6400 devices. Detection requires checking for unauthorized access to VPN configuration endpoints. Inspect network traffic for unencrypted or improperly secured VPN configuration requests. Verify if VPN settings can be modified without credentials by attempting to access configuration pages or APIs remotely.

Impact Analysis

A remote unauthenticated attacker could exploit this to disclose or modify VPN configuration details. This may lead to unauthorized network access, data breaches, or disruption of VPN services, potentially exposing sensitive communications or internal resources.

Compliance Impact

This vulnerability could lead to unauthorized access to VPN configurations, potentially exposing sensitive data. This may violate compliance requirements for data protection and privacy, such as GDPR or HIPAA, depending on the data transmitted through the VPN.

Mitigation Strategies

Immediately update the firmware of Archer MR600 (v2, v3, v5) and TL-MR6400 v8 to the latest version to address the missing authentication vulnerability in VPN configuration management.

Hi! I’m here to help you understand CVE-2026-76653. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70