CVE-2026-8619 is a high severity NULL pointer dereference in the HTTP service of the TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2. A crafted HTTP request from an adjacent network crashes the web management service. TP-Link has published fixed firmware for each model.
What's affected
TP-Link's advisory (FAQ 5253, last updated 19 August 2026) lists these models, each with a fixed firmware build:
- TL-MR100 v3.2: TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957n
- Archer MR600 v2: Archer MR600(EU)_V2_1.10.0 Build 260618
- TL-MR150 v3.20: TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n
- TL-MR6400 v8.0: TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978n
TP-Link notes that these models are not sold in the U.S. The advisory does not give the earliest vulnerable firmware, so assume anything older than the fixed build is affected.
Severity differs between sources. The record shows CVSS 3.1 at 7.5 (High) with a network attack vector. TP-Link's advisory scores it 7.1 (High) on CVSS 4.0 with an adjacent network vector, meaning the attacker must be on the same network segment rather than anywhere on the internet. The vendor wording is the more specific, so read the description as adjacent access, but do not rely on that to skip the update. The impact in both is availability only. Neither source reports exploitation, and the CVE is not in CISA KEV.
How to check if you're exposed
Log in to the router's management page and read the firmware version from the status or system information screen, then compare it with the fixed build for your model above. The hardware version is printed on the label on the underside of the device, and the advisory is specific about which hardware version it covers.
If you manage several of these devices for a site, such as a small branch network or mobile connectivity kit, list model, hardware version and firmware in a spreadsheet and mark the ones that do not match the fixed builds.
Also check who can reach the web interface. The advisory describes an adjacent network attacker, so the exposure is mostly the people and devices on the same LAN or Wi-Fi.
What to do now
- Find the hardware version on the label, then download the matching firmware from the TP-Link support page for your model.
- Install the fixed build, keeping the router powered during the update.
- Confirm the new firmware version on the status page afterwards.
- Turn off remote management of the web interface if you do not need it, and limit who can join the local network.
- Add these devices to your asset list so future advisories reach someone who owns them.
Why it matters
A NULL pointer dereference (CWE-476) means the HTTP service tried to use something that did not exist after an unusual request. TP-Link calls it improper handling of exceptional request conditions. The result is a crash of the HTTP process, not code execution.
The consequence is that the management interface and anything that depends on HTTP becomes unavailable until the service restarts. For a home router that is an annoyance. For a router acting as primary connectivity for a shop, site office or field kit, it can mean losing the ability to administer the device when something else goes wrong.
Consumer and small business router bugs often linger because nobody owns the firmware update. Putting these four models on a list is most of the fix.
Quick check
Can someone attack this from the internet?
The advisory describes an adjacent network attacker. That means the same local network, not the open internet, unless you expose the interface remotely.
Does the crash damage the router?
TP-Link says the HTTP service crashes, making the web interface and HTTP dependent functions temporarily unavailable.
Sources
- TP-Link advisory FAQ 5253 for CVE-2026-8619
- TP-Link firmware download page, TL-MR100 v3.20
- Safeguard Gold entry for CVE-2026-8619
Last reviewed: 18 October 2026.
