EUVD-2026-43964
GHSA-h838-7g67-j96h
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only access (AV:A) and authenticated low-privileged user (PR:L); privilege escalation to admin yields C:H and I:H on the device, with minor availability exposure.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
1DescriptionCVE.org
A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data.
An authenticated user with sufficient privileges may be able to modify account settings and gain elevated administrative privileges.
AnalysisAI
Privilege escalation in the TP-Link Archer VX1800v v1 HTTP authentication component allows an adjacent-network authenticated user with at least low-level account privileges to inject newline (CRLF) characters into internally constructed configuration data, ultimately elevating to full administrative access on the device. Affected firmware versions are those below v6092.0 Build 260521 RC.7927n; TP-Link has released a patched firmware. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.39% (32nd percentile), consistent with SSVC's 'Exploitation: none' finding.
Technical ContextAI
CWE-93 (Improper Neutralization of CRLF Sequences) describes a class of injection vulnerabilities where newline characters (\r\n or \n) embedded in user-supplied input are not stripped or escaped before being written into structured data - in this case, device configuration files or internal data structures managed by the HTTP authentication component. Because many configuration formats (INI, key=value, HTTP headers) treat newlines as field delimiters, injected newlines can be used to insert synthetic configuration lines or override existing settings. The affected product, identified via CPE cpe:2.3:a:tp-link_systems_inc.:archer_vx1800v_v1:*:*:*:*:*:*:*:*, is a TP-Link SOHO/home broadband router. The vulnerability resides specifically in the HTTP authentication layer, suggesting the injection point is within a login or account-management API endpoint that incorporates user-controlled values into configuration writes without adequate sanitization.
RemediationAI
The primary remediation is upgrading the Archer VX1800v v1 firmware to version 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n or later, available at https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware. The TP-Link advisory at https://www.tp-link.com/us/support/faq/5189/ provides official guidance and upgrade instructions. As a compensating control while patching is scheduled, restrict administrative and account-management interfaces to trusted, isolated VLANs and ensure that guest or low-privileged accounts are disabled or limited to users who are explicitly trusted on the local network. Removing unnecessary low-privileged user accounts reduces the attacker surface since exploitation requires prior authenticated access. There is no indication from available data that this vulnerability can be triggered remotely over the WAN interface, so ensuring the management interface is not exposed to the internet provides additional risk reduction.
More in Archer Vx1800V V1
View allRoot-level OS command injection in the TR-069/CWMP management client of the TP-Link Archer VX1800v v1 gateway lets an at
OS command injection in the TP-Link Archer VX1800v (v1) router lets an adjacent, high-privileged attacker inject shell m
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today