TP-Link TL-WR940N CVE-2026-11409

Exploitation requires (1) network reachability to the router's management interface from the adjacent network - typically the LAN or Wi-Fi segment, per AV:A - and (2) valid administrator credentials for the web UI, per PR:H, since the vulnerable code path is the authenticated IPv6 WAN configuration handler with the connection type set to PPPoE. The attacker must specifically reach the IPv6 PPPoE configuration form and supply a crafted PPPoE parameter; routers configured with a non-PPPoE IPv6 WAN type do not invoke the vulnerable handler during normal operation, though an authenticated admin can switch to PPPoE at will. No user interaction by a second party is required (UI:N), and exploitation is limited to TL-WR940N hardware revision v6 on firmware older than V6_260528.

The provided CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) and score of 8.5 paint a coherent picture: an attacker must already be on the adjacent network (LAN/Wi-Fi) and must already hold administrator credentials, but once those preconditions are met, exploitation is reliable and yields full control of the device. EPSS data was not provided, the CVE is not listed in CISA KEV, and no public PoC is referenced, so this is best treated as a credible post-authentication device-takeover bug rather than an internet-spray threat. The realistic risk concentrates on routers exposed to untrusted internal users, those with weak/default admin passwords, those whose admin UI is reachable from the WAN, and as a second-stage capability after credential phishing or CSRF against the admin session - situations where the PR:H barrier is effectively lowered.

An attacker who has obtained the router's administrator password - for example by guessing a default/weak credential, reusing leaked credentials, or coercing an authenticated admin's browser via CSRF on the LAN - logs into the TL-WR940N v6 web UI, navigates to the IPv6 WAN connection page, selects PPPoE, and submits a connection parameter (such as the service name or username) containing shell metacharacters followed by an arbitrary command. The vulnerable handler concatenates the value into a system command, the shell executes the injected payload with the router's elevated privileges, and the attacker gains a persistent foothold on the device suitable for DNS hijacking, traffic interception, or pivoting deeper into the network. No public PoC has been published at time of analysis.