Which versions of TP-Link Archer VX1800v are affected by CVE-2026-15428?

TP-Link Archer VX1800v (v1) routers contain a command injection vulnerability that allows adjacent network attackers with high-level administrative privileges to execute arbitrary commands as root…. A patch is available.

How to fix or mitigate CVE-2026-15428?

Within 24 hours, complete an inventory of all TP-Link Archer VX1800v (v1) routers across the organization, document current firmware versions, and verify the exact affected models against TP-Link's security advisory (noting the model naming discrepancy in CVE documentation). Within 7 days, download the vendor-released patch from TP-Link's official support portal, test the firmware update in a controlled environment, and establish a priority-based patching schedule based on network criticality. Within 30 days, deploy the patched firmware to all affected production routers, validate that all devices are running the corrected firmware version, and update your asset inventory and compliance records.

TP-Link Archer VX1800v CVE-2026-15428

Q: What is the CVSS score of CVE-2026-15428?

CVE-2026-15428 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-43963 HIGH

OS Command Injection (CWE-78)

2026-07-14 TPLink

GHSA-fxq7-2872-5xg8

RCE Command Injection Archer Vx1800V V1 Tp Link Systems Inc

8.5

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Adjacent HTTP interface (AV:A), no special conditions once reached (AC:L), an authenticated admin session is required (PR:H), no user interaction, and root command execution gives full C/I/A impact.

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:34 vuln.today

CVE Published

Jul 14, 2026 - 17:03 cve.org

HIGH 8.5

DescriptionCVE.org

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges.

Successful exploitation may allow remote code execution and complete compromise of the device.

AnalysisAI

OS command injection in the TP-Link Archer VX1800v (v1) router lets an adjacent, high-privileged attacker inject shell metacharacters through the domain name parameter of an HTTP management interface, yielding arbitrary command execution as root and full device takeover. The flaw scores CVSS 4.0 8.5 (High) and a vendor firmware patch is available; no public exploit identified at time of analysis. Note a naming discrepancy in the source data - the free-text description says 'VX800v' while the CPE and tags reference 'VX1800V' - so verify the exact affected model against the TP-Link advisory before acting.

Technical ContextAI

The Archer VX1800v is a TP-Link home/SMB gateway router whose web management interface accepts a domain name configuration parameter. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command) - the firmware passes the attacker-supplied domain string into an underlying shell command without sanitizing shell metacharacters (e.g. ;, |, &, `, $()). Embedded router firmware of this class typically runs its web daemon and helper utilities as root under BusyBox/Linux, so injected commands inherit root privileges. The affected product is identified as cpe:2.3:a:tp-link_systems_inc.:archer_vx1800v_v1, hardware/firmware revision v1.

RemediationAI

Patch available per vendor advisory: apply the latest Archer VX1800v firmware from the TP-Link download page (https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware) and review the FAQ advisory (https://www.tp-link.com/us/support/faq/5189/); an exact fixed version string was not provided in the input, so select the newest build TP-Link publishes for the v1 model. Because exploitation requires adjacent access plus administrative privileges, effective compensating controls until patching include restricting access to the web management interface to a trusted management VLAN or wired LAN only (disabling remote/WAN and Wi-Fi guest access to the admin UI), changing default administrator credentials and enforcing strong unique admin passwords to prevent an attacker from reaching the PR:H precondition, and segmenting the router's management plane away from untrusted Wi-Fi clients - the trade-off is reduced administrative convenience and the need to reach the device from a designated management network.