EUVD-2026-54655
GHSA-r6p4-crm5-rwvh
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent network and admin authentication required per CVSS 4.0 source; pure availability impact with no scope change justifies S:U and C/I:N.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations.
By sending crafted systool instructions through the asynchronous request path, successful exploitation may cause the httpd process or device management service to crash and may result in temporary loss of access to the web management interface or device reboot.
AnalysisAI
Denial-of-service in the TP-Link Archer A6 v4 httpd service allows an adjacent, authenticated attacker to crash the web management process or force a device reboot by exploiting a race condition in the asynchronous systool instruction handling path. All firmware builds prior to V4_1.15.10 Build 260625 Rel.25447 are affected; a vendor-released patch has been issued. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must all be met: (1) the attacker must be on the same adjacent network segment (LAN or Wi-Fi) as the targeted device, as specified by AV:A in the CVSS 4.0 vector - internet-based remote attackers are excluded by design; (2) the attacker must hold high-privilege administrator credentials for the router management interface, as specified by PR:H - unauthenticated and low-privilege users cannot trigger this path; (3) the device must be running firmware older than V4_1.15.10 Build 260625 Rel.25447. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.8 (Medium) accurately captures the constrained attack surface: AV:A limits exploitation to attackers on the same LAN or Wi-Fi segment, and PR:H mandates administrator-level authentication before any exploitation is possible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with administrator credentials and LAN or Wi-Fi adjacency authenticates to the Archer A6 v4 management interface and sends a sequence of crafted concurrent systool instructions via the asynchronous request path, deliberately racing the async handler's shared state. The httpd service crashes and either temporarily drops the management interface or triggers a full device reboot, disrupting connectivity for all users on the segment. … |
| Remediation | Upgrade to firmware version V4_1.15.10 Build 260625 Rel.25447 or later, which is available at the TP-Link Archer A6 v4 firmware download page (https://www.tp-link.com/us/support/download/archer-a6/v4/#Firmware for US, or https://www.tp-link.com/en/support/download/archer-a6/v4/#Firmware internationally). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Archer A6 V4
View allSame weakness CWE-362 – Race Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today