Archer A6 CVE-2026-9030

Three specific conditions must all be met: (1) the attacker must be on the same adjacent network segment (LAN or Wi-Fi) as the targeted device, as specified by AV:A in the CVSS 4.0 vector - internet-based remote attackers are excluded by design; (2) the attacker must hold high-privilege administrator credentials for the router management interface, as specified by PR:H - unauthenticated and low-privilege users cannot trigger this path; (3) the device must be running firmware older than V4_1.15.10 Build 260625 Rel.25447. Exploitation is further bounded by the impact ceiling: only availability is affected (crash or reboot), with no code execution, credential theft, persistent implant, or lateral movement possible. Default Archer A6 v4 deployments require admin password authentication and expose management only on the LAN interface, meaning no non-default configuration is necessary for the vulnerability to be present, but the LAN-adjacency and admin-authentication bars meaningfully limit the realistic attacker population.

The CVSS 4.0 score of 6.8 (Medium) accurately captures the constrained attack surface: AV:A limits exploitation to attackers on the same LAN or Wi-Fi segment, and PR:H mandates administrator-level authentication before any exploitation is possible. Impact is purely availability-based (VA:H) with no confidentiality or integrity effects on the vulnerable or subsequent systems, making the real-world damage ceiling a temporary management interface outage or a device reboot. No EPSS probability was provided in the source data. The vulnerability is not present in the CISA KEV catalog and no public proof-of-concept exploit has been identified, indicating no evidence of opportunistic or widespread exploitation. SSVC signals reinforce low urgency: exploitation requires both authenticated adjacent access and deliberate concurrent request crafting, with no possibility of code execution, lateral movement, or data exfiltration. The primary residual risk applies to environments where router admin credentials are broadly shared or where an insider threat is present. This should be treated as a low-urgency finding addressed in the next routine firmware maintenance cycle.

An attacker with administrator credentials and LAN or Wi-Fi adjacency authenticates to the Archer A6 v4 management interface and sends a sequence of crafted concurrent systool instructions via the asynchronous request path, deliberately racing the async handler's shared state. The httpd service crashes and either temporarily drops the management interface or triggers a full device reboot, disrupting connectivity for all users on the segment. No public exploit code exists; an attacker would need to reverse-engineer the systool async API to craft the concurrent request sequence.