CVEvulnerability
CVE-2026-12339
6.9 MEDIUM
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-08-10
- Last modified
- 2026-10-23
- Assigner
- f23511db-6c3e-4e32-a477-6aa17d310630
- CVSS 4.0 (f23511db-6c3e-4e32-a477-6aa17d310630)
- 6.9 MEDIUM — CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weaknesses
- CWE-22
Description
A Zip Slip vulnerability in the WebUI ISP
Upgrade functionality allows arbitrary file write via a crafted archive
containing directory traversal sequences. An authenticated administrator may
overwrite arbitrary files on the system.Successful
exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware www.tp-link.com
- https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware www.tp-link.com
- https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware www.tp-link.com
- https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware www.tp-link.com
- https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware www.tp-link.com
- https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware www.tp-link.com
- https://www.tp-link.com/en/support/faq/5237/ www.tp-link.com
- https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware www.tp-link.com