CVE-2026-17251: TP-Link Systems Inc Tl-MR6400 v7.0

High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days.

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of  TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of management or CGI functionality until service recovery.

Affected products

Published 2026-08-21. Last modified 2026-08-28.