EUVD-2026-43962
GHSA-pjj3-47vg-vqcj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack traverses the network CWMP channel (AV:N) but requires control of the trusted ACS (PR:H); no user interaction, and successful injection yields full root compromise (C/I/A:H).
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
2DescriptionCVE.org
An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069 being enabled and ability to influence ACS-delivered commands, compromise or control an ACS server.
Successful exploitation may allow arbitrary command execution with root privileges, resulting in complete compromise of the device.
AnalysisAI
Root-level OS command injection in the TR-069/CWMP management client of the TP-Link Archer VX1800v v1 gateway lets an attacker who controls (or has compromised) the ACS provisioning server inject unsanitized parameters that the device executes as system-level commands. Because CWMP provisioning is trusted implicitly, a malicious or hijacked ACS can push crafted values that yield arbitrary command execution as root and full device takeover. No public exploit identified at time of analysis, and the flaw was reported by TP-Link itself; a firmware fix is available.
Technical ContextAI
TR-069 (CPE WAN Management Protocol / CWMP) is the standard used by ISPs to remotely provision and manage customer-premises equipment such as this VDSL/Wi-Fi gateway. The device runs a CWMP client that receives parameter values (SetParameterValues, Download, and similar RPCs) from an Auto Configuration Server (ACS). This vulnerability is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the CWMP client passes ACS-supplied parameter strings into a system shell without sufficient validation or sanitization, so shell metacharacters embedded in a provisioning parameter break out of the intended command and run as new commands. The affected component is identified by CPE cpe:2.3:a:tp-link_systems_inc.:archer_vx1800v_v1, i.e. firmware for the Archer VX1800v v1 hardware revision only.
RemediationAI
Patch available per vendor advisory: update the Archer VX1800v v1 to the latest firmware from the TP-Link download page (https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware); the exact fixed version was not stated in the available data, so apply the most recent firmware listed for this model and confirm the build post-update. Follow vendor guidance at https://www.tp-link.com/us/support/faq/5189/. Where the device is operator-managed, the primary compensating control is hardening the CWMP trust boundary: ensure the ACS connection uses TLS with strict server-certificate validation and mutual authentication so a rogue or MITM ACS cannot impersonate the real one, and restrict ACS reachability so only the legitimate provisioning server can talk to the CWMP client (side effect: misconfigured TLS or ACL can break legitimate remote provisioning). If TR-069 is not needed, disabling the CWMP/TR-069 feature entirely removes the attack surface, at the cost of losing ISP remote-management capability. Also protect the ACS infrastructure itself, since its compromise is the main exploitation path.
More in Archer Vx1800V V1
View allOS command injection in the TP-Link Archer VX1800v (v1) router lets an adjacent, high-privileged attacker inject shell m
Privilege escalation in the TP-Link Archer VX1800v v1 HTTP authentication component allows an adjacent-network authentic
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today