CVE-2026-17251

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of management or CGI functionality until service recovery.

CVSS

No CVSS.

References

Link	Resource
https://www.tp-link.com/en/support/download/tl-mr6400/v7/#Firmware
https://www.tp-link.com/tw/support/download/tl-mr6400/v7/#Firmware
https://www.tp-link.com/us/support/faq/5259/

Configurations

No configuration.

History

14 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de desreferencia de puntero NULL existe en la funcionalidad de análisis de solicitudes HTTP de TL-MR6400 v7. Un atacante remoto no autenticado puede activar la vulnerabilidad enviando una solicitud HTTP especialmente diseñada que contiene un encabezado de cookie de sesión malformado. La explotación exitosa puede causar que el proceso del servicio HTTP falle, lo que resulta en una condición de denegación de servicio y la pérdida temporal de la funcionalidad de gestión o CGI hasta la recuperación del servicio.

Information

Published : 2026-08-21 18:16

Updated : 2026-10-14 19:10

NVD link : CVE-2026-17251

Mitre link : CVE-2026-17251

CVE.ORG link : CVE-2026-17251

JSON object : View

Products Affected

No product.

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-17251", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17251", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T17:40:25.485077Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "TL-MR6400 v7.0", "versions": [{"status": "affected", "version": "0", "lessThan": "1.9.0 Build 260714", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T18:16:47.660", "references": [{"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v7/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/tw/support/download/tl-mr6400/v7/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5259/", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "A NULL\npointer dereference vulnerability exists in the HTTP request parsing\nfunctionality of\u00a0\nTL-MR6400 v7. An unauthenticated remote attacker can\ntrigger the vulnerability by sending a specially crafted HTTP request\ncontaining a malformed session cookie header. \n\n\n\n\n\nSuccessful\nexploitation may cause the HTTP service process to crash, resulting in a\ndenial-of-service condition and temporary loss of management or CGI\nfunctionality until service recovery."}, {"lang": "es", "value": "Una vulnerabilidad de desreferencia de puntero NULL existe en la funcionalidad de an\u00e1lisis de solicitudes HTTP de TL-MR6400 v7. Un atacante remoto no autenticado puede activar la vulnerabilidad enviando una solicitud HTTP especialmente dise\u00f1ada que contiene un encabezado de cookie de sesi\u00f3n malformado.\n\nLa explotaci\u00f3n exitosa puede causar que el proceso del servicio HTTP falle, lo que resulta en una condici\u00f3n de denegaci\u00f3n de servicio y la p\u00e9rdida temporal de la funcionalidad de gesti\u00f3n o CGI hasta la recuperaci\u00f3n del servicio."}], "lastModified": "2026-10-14T19:10:00.297", "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}