Answer in brief
CVE-2026-8619 records a High severity (CVSS 7.1) vulnerability in Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600. The current sources do not mark it as known exploited. The current feed maps TP-Link Systems Inc/Archer MR600 v2 (generic), TP-Link Systems Inc./TL-MR100 v3.2 (generic), TP-Link Systems Inc./TL-MR150 v.3.2 (generic), TP-Link Systems Inc./TL-MR6400 v8.0 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps TP-Link Systems Inc/Archer MR600 v2 (generic), TP-Link Systems Inc./TL-MR100 v3.2 (generic), TP-Link Systems Inc./TL-MR150 v.3.2 (generic), TP-Link Systems Inc./TL-MR6400 v8.0 (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:h:tp-link:archer_mr600:2.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:h:tp-link:tl-mr100:3.2:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:h:tp-link:tl-mr150:3.2:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:h:tp-link:tl-mr6400:8.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:tp-link:archer_mr600_firmware:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:tp-link:tl-mr100_firmware:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:tp-link:tl-mr150_firmware:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:tp-link:tl-mr6400_firmware:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| TP-Link Systems Inc/Archer MR600 v2generic | >=0 <Archer MR600(EU)_V2_1.10.0 Build 260618 | Archer MR600(EU)_V2_1.10.0 Build 260618 |
| TP-Link Systems Inc./TL-MR100 v3.2generic | >=0 <TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957n | TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957n |
| TP-Link Systems Inc./TL-MR150 v.3.2generic | >=0 <TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n | TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n |
| TP-Link Systems Inc./TL-MR6400 v8.0generic | >=0 <TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978n | TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978n |
Published upstream
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 19, 2026
An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable.
Quoted source text, attributed separately from HOL analysis.