Skip to main content

TP-Link Archer C20 CVE-2026-75616

| EUVDEUVD-2026-63081 HIGH
OS Command Injection (CWE-78)
2026-08-19 TPLink GHSA-5w3w-j62r-pw52
Command Injection Archer C20 V6
8.5
CVSS 4.0 · Vendor: TPLink
Share

Severity by source

Vendor (TPLink) PRIMARY
8.5 HIGH
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.8 MEDIUM

Adjacent vector reflects LAN-bound management interface; PR:H required for admin credentials per CVSS 4.0 source vector; full CIA impact on device with unchanged scope.

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 19, 2026 - 21:38 vuln.today
CVE Published
Aug 19, 2026 - 20:44 cve.org
HIGH 8.5

DescriptionCVE.org

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise.

Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it.

AnalysisAI

OS command injection in the TP-Link Archer C20 v6 web management interface enables an authenticated administrator to execute arbitrary system commands by submitting crafted WAN configuration inputs that bypass insufficient input validation. Full device compromise - confidentiality, integrity, and availability - is achievable for all traffic routed through the affected device. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain admin credentials via default password or credential reuse
Delivery
Access web management UI from LAN (or WAN if remote management enabled)
Exploit
Submit crafted WAN configuration input with OS metacharacters
Execution
Firmware passes unsanitized input to shell execution function
Persist
Execute arbitrary commands with elevated privileges
Impact
Full device compromise
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two concrete preconditions: (1) the attacker must have network-layer adjacency to the Archer C20 v6 web management interface - typically the LAN segment, or the WAN if remote management is explicitly enabled by the device owner; and (2) the attacker must possess valid administrator-level credentials for the device (CVSS PR:H). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N) yields a score of 8.5, which accurately reflects two substantive mitigating factors: adjacency requirement and high-privilege prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained valid Archer C20 v6 administrator credentials - through default credential abuse, credential reuse, or phishing the device owner - connects to the web management interface from the local network and navigates to a WAN configuration function. By submitting a parameter value containing OS command metacharacters (e.g., semicolons or backticks), the attacker causes the firmware to execute attacker-supplied shell commands with elevated privileges, enabling persistent backdoor installation, traffic interception, or full device reconfiguration.
Remediation The primary remediation is to apply the vendor-released firmware patch available from TP-Link's official download pages at https://www.tp-link.com/us/support/download/archer-c20/v6.46/#Firmware and https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware; the exact patched version number should be verified against the advisory at https://www.tp-link.com/en/support/faq/5252/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify and inventory all TP-Link Archer C20 v6 devices in production; document current firmware versions and restrict administrative access to essential personnel only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Archer C20 V6

View all
CVE-2026-11834 HIGH
8.7 Jun 22

Command injection in TP-Link Archer and TL-MR series routers allows an adjacent unauthenticated attacker on the same bro
CVE-2026-12001 MEDIUM
5.2 Jul 27

Hardcoded credentials in TP-Link router firmware allow attackers with physical access to gain unauthorized access to pri

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-75616 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy