CVE-2026-12339: Authenticated Arbitrary File Write Vulnerability in multiple devices

Medium severity · published Aug 10, 2026

CVE-2026-12339

Authenticated Arbitrary File Write Vulnerability in multiple devices

6.9

CVSS

0.5%

EPSS

On KEV

Description

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 44% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Archer MR200 v7 · TP-Link Systems Inc.

before (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n · source: vendor

Archer MR600 v2 · TP-Link Systems Inc.

before (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n · source: vendor

TL-MR100 v3.20 · TP-Link Systems Inc.

before (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n; before 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, Customized Software for South Korea KT; before 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor · source: vendor

TL-MR150 v3.20 · TP-Link Systems Inc.

before (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n · source: vendor

TL-MR6400 v5.3 · TP-Link Systems Inc.

before (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n · source: vendor

TL-MR6400 v8.0 · TP-Link Systems Inc.

before (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n · source: vendor

Affected product

Archer MR200 v7

TP-Link Systems Inc.

All Archer MR200 v7 CVEs

References

NVD