CVE-2026-12339

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12339", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-06-15T15:51:52.827Z", "datePublished": "2026-08-10T18:20:50.576Z", "dateUpdated": "2026-08-25T23:31:52.397Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-08-25T23:31:52.397Z"}, "title": "Authenticated Arbitrary File Write Vulnerability in multiple devices", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-17", "descriptions": [{"lang": "en", "value": "CAPEC-17 Using Malicious Files"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "TL-MR6400 v5.3", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer MR600 v2", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer MR200 v7", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "TL-MR6400 v8.0", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "TL-MR150 v3.20", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "TL-MR100 v3.20", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, \u00a0Customized Software for South Korea KT", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.Successful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.<div>Successful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability. </div>"}]}], "references": [{"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/faq/5237/", "tags": ["vendor-advisory"]}, {"url": "https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "MrBruh", "type": "finder"}, {"lang": "en", "value": "haehet", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T14:44:35.924185Z", "id": "CVE-2026-12339", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T14:44:53.124Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12339", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T14:44:35.924185Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T14:44:42.664Z"}}], "cna": {"title": "Authenticated Arbitrary File Write Vulnerability in multiple devices", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "MrBruh"}, {"lang": "en", "type": "finder", "value": "haehet"}], "impacts": [{"capecId": "CAPEC-17", "descriptions": [{"lang": "en", "value": "CAPEC-17 Using Malicious Files"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "TL-MR6400 v5.3", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer MR600 v2", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer MR200 v7", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "TL-MR6400 v8.0", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "TL-MR150 v3.20", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "TL-MR100 v3.20", "versions": [{"status": "affected", "version": "0", "lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, \u00a0Customized Software for South Korea KT", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/faq/5237/", "tags": ["vendor-advisory"]}, {"url": "https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.Successful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.", "supportingMedia": [{"type": "text/html", "value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.<div>Successful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability. </div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-08-25T23:31:52.397Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12339", "state": "PUBLISHED", "dateUpdated": "2026-08-25T23:31:52.397Z", "dateReserved": "2026-06-15T15:51:52.827Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-08-10T18:20:50.576Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "TL-MR6400 v5.3", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Archer MR600 v2", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Archer MR200 v7", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "TL-MR6400 v8.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "(EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "TL-MR150 v3.20", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "TL-MR100 v3.20", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, \u00a0Customized Software for South Korea KT", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.Successful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability."}, {"lang": "es", "value": "Una vulnerabilidad Zip Slip en la funcionalidad de actualizaci\u00f3n ISP de la WebUI permite la escritura arbitraria de archivos a trav\u00e9s de un archivo comprimido manipulado que contiene secuencias de salto de directorio. Un administrador autenticado puede sobrescribir archivos arbitrarios en el sistema. La explotaci\u00f3n exitosa puede permitir la sobrescritura arbitraria de archivos en el sistema subyacente, afectando la integridad y disponibilidad del sistema."}], "id": "CVE-2026-12339", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12339", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T14:44:35.924185Z", "version": "2.0.3"}}]}, "published": "2026-08-10T19:17:28.500", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/faq/5237/"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,(EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n)"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 84.0, "source": "matching"}]}, "original": {"product": "Archer MR200 v7", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_mr200_v07", "vendor": "tp-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,(EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer MR600 v2", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_mr600_v2", "vendor": "tp-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,(EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "TL-MR6400 v5.3", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "tl-mr6400_v5.3", "vendor": "tp-link"}], "created": "2026-08-10T19:30:17.194920+00:00", "updated": "2026-08-26T04:45:05.088441+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$archer_mr200_v07", "tp-link$PRODUCT$archer_mr600_v2", "tp-link$PRODUCT$tl-mr6400_v5.3"]}