Archer VX1800v CVE-2026-15429

Exploitation requires three concrete prerequisites: (1) The attacker must have adjacent network access - they must be on the same local network segment as the router's management interface (CVSS AV:A); (2) The attacker must hold a valid, low-privileged user account on the device (CVSS PR:L) - the description specifically states 'authenticated user with sufficient privileges,' implying at least account-modification rights, not just any authenticated session; (3) The device must be running firmware prior to build v6092.0 Build 260521 RC.7927n. Exploitation is not automatable at scale (SSVC Automatable: no) and does not require user interaction (UI:N). Factors limiting exploitation: the AV:A constraint eliminates direct internet exploitation; the PR:L requirement eliminates unauthenticated attackers; and the 'sufficient privileges' qualifier may exclude read-only or minimally scoped accounts from triggering the vulnerability.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.1 (Medium), reflecting adjacent-network-only exposure and a requirement for prior low-privileged authentication - two factors that substantially constrain real-world risk. EPSS at 0.39% (32nd percentile) and SSVC 'Exploitation: none' both confirm no observed exploitation activity. However, a notable tension exists between the CVSS impact sub-scores (VC:L/VI:L/VA:L) and the SSVC 'Technical Impact: total' rating: the description explicitly states the outcome is elevated administrative privileges on the device, which on a router effectively means full control over routing, DNS, firewall, and connected devices - more consistent with a total technical impact than with Low C/I/A. Defenders should treat the real-world impact as higher than the raw CVSS score implies, while the AV:A and PR:L prerequisites meaningfully limit the attacker population to those who are already on the local network segment and hold a valid (though non-admin) account. This is not a remote, unauthenticated mass-exploitation scenario.

An attacker who has gained or possesses a low-privileged user account on the Archer VX1800v - for example, a shared household member or a guest network user with local LAN access - connects to the router's HTTP authentication interface and submits a crafted account-settings request containing injected newline characters. The unsanitized input is written into the device's internal configuration data, inserting or overwriting fields in a way that grants the attacker's account administrative privileges, effectively giving full control over the router's configuration without requiring the administrator password.