---
cve: "CVE-2026-12339"
severity: "MEDIUM"
cvss: 6.9
epss: "0.3%"
vendor: "TP-Link Systems Inc."
kev: false
exploited: false
published: "2026-08-10 19:17:28"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-21T06:29:59+02:00"
---

# CVE-2026-12339

> 6.9 MEDIUM

## Beschreibung

A Zip Slip vulnerability in the WebUI ISP
Upgrade functionality allows arbitrary file write via a crafted archive
containing directory traversal sequences. An authenticated administrator may
overwrite arbitrary files on the system.Successful
exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

## CVSS-Vektor

```
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Benachbart | warn |
| AC Komplexität | Gering | bad |
| PR Privilegien | Hoch | good |
| UI Interaktion | Keine | bad |

## Referenzen

- <https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware>
- <https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware>
- <https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware>
- <https://www.tp-link.com/en/support/faq/5237/>
- <https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware>
- <https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware>
- <https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware>
- <https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-12339) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_