EUVD-2026-37499Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent LAN/Wi-Fi reach to admin UI (AV:A), low complexity once authenticated (AC:L), administrator login required (PR:H), no user interaction, and full device compromise gives C/I/A:H.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
1DescriptionCVE.org
An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.
AnalysisAI
Authenticated OS command injection in the TP-Link TL-WR940N v6 router's IPv6 PPPoE configuration handler allows administrators to break out of the configuration parser and execute arbitrary shell commands with elevated (typically root) privileges on the device. The flaw was reported by TP-Link itself and a firmware fix is available; no public exploit identified at time of analysis. Risk is bounded by the CVSS 4.0 vector requiring adjacent-network access and high privileges (AV:A/PR:H), but post-exploitation impact on confidentiality, integrity, and availability is rated High.
Technical ContextAI
The TL-WR940N v6 is a consumer/SOHO wireless N router whose web management interface accepts IPv6 PPPoE connection parameters (typically service name, username, password, and related connection fields) that are passed to underlying system utilities - likely via shell invocation in the embedded Linux/BusyBox environment used by TP-Link's firmware. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that one or more of these PPPoE input fields are concatenated into a command string without escaping shell metacharacters such as ';', '|', '`', or '$()', so a crafted value is interpreted as additional commands by the shell. The affected CPE cpe:2.3:a:tp-link_systems_inc.:tl-wr940n_v6:*:*:*:*:*:*:*:* identifies hardware revision v6 specifically; earlier hardware revisions of the TL-WR940N run different firmware images and are not covered by this advisory.
RemediationAI
Vendor-released patch: TL-WR940N v6 firmware build V6_260528 (or later), available from https://www.tp-link.com/en/support/download/tl-wr940n/v6/#Firmware and https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware, with vendor context at https://www.tp-link.com/us/support/faq/5131/ - upgrade affected devices to this build as the primary remediation. Until the firmware can be applied, change the default/weak admin password to a long unique secret and disable remote (WAN-side) management of the web UI so that only trusted LAN hosts can reach the configuration interface, accepting the trade-off that legitimate remote administration will require a VPN. Where IPv6 PPPoE is not in use, leave the IPv6 WAN connection type set to something other than PPPoE so the vulnerable handler is not invoked, noting that this is a workaround rather than a fix and does not protect against an admin who can change the WAN configuration. On networks where guests or untrusted users share the LAN/Wi-Fi, segment the router's management VLAN/SSID away from those users to remove the AV:A precondition.
More in Tl Wr940N V6
View allRemote code execution and denial-of-service in the TP-Link TL-WR940N v6 router stem from a stack-based buffer overflow i
Authenticated OS command injection in the TP-Link TL-WR940N v6 router's BigPond Cable (BPA) WAN configuration module all
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today