A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Aug 21, 2026 · NIST NVD

   Detected

   A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of mana

2. Oct 14, 2026 · NIST NVD

   Updated

   A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of mana

Sources

• CVE.orgVulnerability recordCVE-2026-17251

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-17251

  30-day exploitation probability 0.5%

  first.org
• NIST NVDVulnerability recordCVE-2026-17251

  A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful

  nvd.nist.gov

References

• Reference · tp-link.com
• Reference · tp-link.com
• Reference · tp-link.com