Which versions of TP-Link Archer are affected by CVE-2026-11834?

TP-Link Archer and TL-MR series routers contain a critical command injection vulnerability (CVE-2026-11834, CVSS 8.7) that allows adjacent network attackers to execute arbitrary commands with…. A patch is available.

How to fix or mitigate CVE-2026-11834?

Within 24 hours: Identify all TP-Link Archer and TL-MR series routers deployed and document current firmware versions. Within 7 days: Contact TP-Link for latest patched firmware versions specific to each affected model and validate patches in lab environment. Within 30 days: Deploy patches to all affected devices, prioritizing production network infrastructure and Internet-facing installations.

TP-Link Archer CVE-2026-11834

Q: What is the CVSS score of CVE-2026-11834?

CVE-2026-11834 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38339 HIGH

OS Command Injection (CWE-78)

2026-06-22 TPLink

GHSA-w296-94hj-pfcg

Command Injection TP-Link Archer Mr200 V07 Archer Mr200 V8 Archer Mr402 V1 Archer Vr2100 V1 Archer C20 V5 Archer C20 V6 Tl Mr6400 V7 Tp Link Systems Inc

8.7

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Adjacent network DHCP attack with no auth or user interaction; unsanitized option parsing yields straightforward command injection as root, giving full CIA impact on the router itself.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 19:01 vuln.today

DescriptionCVE.org

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized command execution during device initialization or provisioning workflows. This typically occurs when the device is in a factory-default or unconfigured state.

Successful exploitation may allow an adjacent, unauthenticated attacker to execute arbitrary commands with elevated privileges, potentially leading to full compromise of the affected device and unauthorized administrative control.

AnalysisAI

Command injection in TP-Link Archer and TL-MR series routers allows an adjacent unauthenticated attacker on the same broadcast domain to execute arbitrary commands with elevated privileges by supplying crafted DHCP option responses. The flaw resides in DHCP client option processing during device initialization and is most reliably triggered when the router is in factory-default or unconfigured state. No public exploit identified at time of analysis, but the vendor (TP-Link) has confirmed the issue and released firmware patches.

Technical ContextAI

The vulnerability is a classic CWE-78 (OS Command Injection) in the DHCP client logic of TP-Link's residential/SMB router firmware. When the device acts as a DHCP client during provisioning, it processes server-supplied DHCP options (such as hostname, domain, vendor-specific, or boot-file fields) and passes attacker-controllable strings into shell or system() invocations without sanitization. Affected SKUs per CPE include Archer MR200 (v07, v8), Archer MR402 v1, Archer VR2100 v1, Archer C20 (v5, v6), and TL-MR6400 v7 - a mix of LTE/4G, DSL, and standard Wi-Fi routers that share a common firmware lineage where the DHCP client component is reused across product families.

RemediationAI

Patch available per vendor advisory: install the latest firmware for the specific affected model from the TP-Link support pages (https://www.tp-link.com/us/support/faq/5141/ and the per-model firmware downloads for Archer C20, MR200, MR402, VR2100, and TL-MR6400 v7). Until firmware is applied, complete initial provisioning in a controlled environment rather than on an untrusted broadcast segment, avoid connecting the WAN port directly to a shared/ISP segment before the device is configured, and after the device leaves factory-default state the attack surface is reduced per the description. As a network-layer compensating control, restrict L2 adjacency by isolating router setup on a dedicated VLAN or trusted switch port, and where supported by upstream infrastructure, enable DHCP snooping on switches between any potentially hostile host and the router's DHCP-client interface (trade-off: DHCP snooping requires managed switching gear and correct trust-port configuration, otherwise it can break legitimate DHCP).