CVE-2026-76653CWE-126

CVE-2026-76653

published September 11, 2026

CVSS
5.3
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

A missing

authentication vulnerability in the VPN configuration management has been

identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker

may be able to access and modify VPN configuration information without valid

credentials.

Successful

exploitation may allow a remote unauthenticated attacker to disclose and modify

VPN configuration information.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
5.3 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-126 · Buffer Over-read
Published
2026-09-11T01:17Z
References (3)
https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/faq/5292/ · f23511db-6c3e-4e32-a477-6aa17d310630
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 20:12Z
    Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600
    cvelistv5