The CVE describes a stack-based out-of-bounds write in the TL-MR6400's login request handling — a vulnerability class that typically enables code execution — yet the disclosed impact lists only denial of service. This gap should concern you more than the CVSS 7.1 score suggests.
Start by verifying your deployment context. The 'adjacent' requirement in the CVSS vector implies the attacker needs network proximity, but for a 4G router this threshold is lower than it appears: guests on WiFi, neighbors within wireless range, or any compromised device already on the LAN (smart TV, camera, IoT bulb) qualifies. This is a gateway device — crashing it doesn't just take down the admin panel, it severs the primary uplink for every device relying on it. The blast radius from a single compromised endpoint crashing the router is network-wide, not localized.
The more important question is whether the DoS-only impact is accurate. TP-Link has a documented pattern across multiple CVEs where authentication-adjacent stack overflows are initially disclosed as DoS-only, then later confirmed as code execution by independent research. The historical record suggests treating the vendor's impact description as a floor, not a ceiling. Check whether your firmware version has been independently analyzed — the login handler sits before session state is established, meaning no CSRF tokens or rate limiting are in play at the crash point, which itself signals shallow defensive depth in that code path.
Prioritise these actions: First, assume code execution is possible until proven otherwise and treat this as a high-severity finding in your risk model, not a mere DoS. Second, verify whether your specific firmware version implements stack canaries or NX bits on the MIPS chipset — the presence of these would constrain exploitation even if the primitive exists. Third, review whether the device's WAN interface is exposed (UPnP, default configurations, or ISPs that don't isolate the public IP), because the 'adjacent' qualifier creates false comfort if the device is functionally reachable from the internet. Fourth, consider the deployment lifecycle: 4G routers are commonly used in transient scenarios (construction sites, temporary installations) where devices are deployed and then abandoned unpatched — the 'temporary DoS' framing assumes someone notices and remediates, which often doesn't happen in practice.