CVE-2026-12339: WebUI ISP Path Traversal Vulnerability

CVE-2026-12339 Overview

CVE-2026-12339 is a Zip Slip path traversal vulnerability [CWE-22] in the WebUI ISP Upgrade functionality of TP-Link router firmware. The flaw allows an authenticated administrator to supply a crafted archive containing directory traversal sequences. Extraction routines fail to sanitize entry paths, letting attackers write files outside the intended upgrade directory. Successful exploitation overwrites arbitrary files on the underlying system, compromising integrity and availability. The vulnerability affects TP-Link Archer MR200, Archer MR600, and TL-MR6400 4G LTE routers exposed to attackers on the local (adjacent) network segment.

Critical Impact
An authenticated administrator on an adjacent network can overwrite arbitrary files on the router's filesystem by uploading a malicious ISP upgrade archive, undermining device integrity and potentially enabling persistent compromise.

Affected Products

TP-Link Archer MR200 (v7) firmware
TP-Link Archer MR600 (v2) firmware
TP-Link TL-MR6400 (v5.30) firmware

Discovery Timeline

2026-08-10 - CVE-2026-12339 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-12339

Vulnerability Analysis

The vulnerability resides in the WebUI ISP Upgrade feature exposed by affected TP-Link router firmware. Administrators can upload an ISP configuration archive through the management interface. The extraction routine processes archive entries without validating that resolved paths remain within the designated staging directory. An attacker who crafts an archive containing entries with ../ sequences or absolute paths can direct the extractor to write files anywhere on the router filesystem. This class of flaw is commonly referred to as Zip Slip and maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. Exploitation requires valid administrator credentials and adjacent network access, which limits opportunistic abuse but does not remove risk in shared or previously breached environments.

Root Cause

The root cause is missing canonicalization and boundary validation on archive entry names during extraction of ISP upgrade bundles. The firmware trusts the paths declared inside the archive rather than resolving each entry against the intended output directory and rejecting paths that escape it.

Attack Vector

Exploitation requires an authenticated administrator session on the router's WebUI reachable from the adjacent network. The attacker constructs an archive whose entries contain directory traversal sequences pointing to sensitive filesystem locations. Uploading and processing the archive through the ISP Upgrade endpoint causes the router to write attacker-controlled content to those locations, allowing overwrite of configuration files, startup scripts, or binaries. See the TP-Link FAQ on Device Issues for vendor-provided context on affected models.

No verified public proof-of-concept is available. The exploitation flow follows
the standard Zip Slip pattern: an archive entry name such as ../../etc/target
is extracted verbatim, causing the write to land outside the intended staging
directory. Refer to the vendor advisories for firmware-specific details.

Detection Methods for CVE-2026-12339

Indicators of Compromise

Unexpected ISP Upgrade archive uploads recorded in router WebUI or administrative audit logs.
Modified timestamps or checksums on router configuration files, startup scripts, or system binaries outside normal patch windows.
Administrator sessions originating from unusual adjacent-network hosts prior to firmware or ISP profile updates.
New or altered files in filesystem locations that the ISP upgrade workflow should never touch.

Detection Strategies

Inspect archive entries at ingress by validating that each resolved path stays within the designated extraction directory.
Enable and centrally forward router administrative logs, then alert on ISP Upgrade actions performed outside change windows.
Baseline the router filesystem where supported and detect drift in configuration, /etc, and boot-time script directories.

Monitoring Recommendations

Forward WebUI authentication and configuration-change events to a central log store for correlation with other network activity.
Monitor management-plane access to the router and alert on administrator logins from hosts that do not normally administer the device.
Track firmware and configuration integrity between authorized maintenance windows to catch unauthorized overwrites.

How to Mitigate CVE-2026-12339

Immediate Actions Required

Apply firmware updates published by TP-Link for Archer MR200, Archer MR600, and TL-MR6400 as soon as fixed builds are available on the vendor download pages.
Restrict access to the router WebUI to a dedicated management VLAN and trusted administrator hosts only.
Rotate administrator credentials and remove any unused administrative accounts on affected devices.
Audit recent ISP Upgrade activity and validate the integrity of router configuration and system files.

Patch Information

TP-Link publishes firmware for the affected models on its official support pages. Download the latest firmware for each device from the TP-Link Archer MR200 Firmware, TP-Link Archer MR600 Firmware, and TP-Link TL-MR6400 Firmware pages. Verify hardware revision compatibility before flashing and confirm the release notes reference the ISP Upgrade Zip Slip fix.

Workarounds

Disable remote management and limit WebUI access to a wired, trusted administrative interface until a patched firmware is installed.
Enforce strong, unique administrator passwords and multi-factor gateways in front of the management network where feasible.
Avoid importing ISP configuration archives from untrusted sources and validate archive provenance before upload.

bash

# Example: restrict router management access at the upstream firewall
# Replace values with your management subnet and router IP
iptables -A FORWARD -s 10.10.20.0/24 -d 192.168.1.1 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80  -j DROP