Deviceways

Router

TP-LINK Archer MR600

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
v2 (EU)
Get OpenWrt firmware Release listed · 25.12.6
v2
Open hardware record
v2
Open hardware record
Original project github.com

Recorded configuration: 16 MB flash; 128 MB RAM

Limitations
DFS
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

TP-LINK Archer MR600 v2 (EU) — TechInfoDepot (github.com)TP-LINK Archer MR600 v2 — TechInfoDepot (github.com)

Hardware revision
v2

Device details

Device details — v2 — Source documentation (openwrt.org)

Hardware revision
v2 (EU)

Hardware details

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 8.5 (v4.0)

Archer MR600 v5

Command Injection in TP-Link's Archer MR600 WireGuard Client Configuration

CVE-2026-8913

Affected firmware
Before EU_V5_1.7.0 0.9.1 260518 rel67803 Before JP_V5_1.2.0 0.9.1 260519 rel52362
Fix
Fix details in the linked record
Read TPLink CVE record
Details and sources
CVE updated

A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.

CVE published

CVSS 8.5 (v4.0)

Archer MR600 v5.0

Authenticated Command Injection Vulnerability in Archer MR600

CVE-2025-14756

Affected firmware
Before 1.1.0 0.9.1 v0001.0 Build 250930 Rel.63611n
Fix
Fix details in the linked record
Read TPLink CVE record
Details and sources
CVE updated

Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console, possibly leading to service disruption or full compromise.

CVE published

CVSS 7.1 (v4.0)

Archer MR600 v2

Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600

CVE-2026-8619

Affected firmware
Before Archer MR600(EU)_V2_1.10.0 Build 260618
Fix
Fix details in the linked record
Read TPLink CVE record
Details and sources
CVE updated

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process.

Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable.

CVE published

CVSS 6.9 (v4.0)

Archer MR600 v2

Authenticated Arbitrary File Write Vulnerability in multiple devices

CVE-2026-12339

Affected firmware
Before (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n
Fix
Fix details in the linked record
Read TPLink CVE record
Details and sources
CVE updated

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

CVE published

CVSS 5.3 (v4.0)

Archer MR600

Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600

CVE-2026-76653

Affected firmware
v3 to before MR600(EU)_V3_1.4.0 Build 260827 v2 to before MR600(EU)_V2_1.12.0 Build 2600826
Fix
Fix details in the linked record
Read TPLink CVE record
Details and sources
CVE updated

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials.

Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.

Check more security advisories for this device · CVE.org