TP-Link Archer A6 CVE-2026-9031

Exploitation requires two concrete prerequisites: (1) adjacent network access - the attacker must be on the same LAN or WLAN segment as the router, ruling out direct internet-based exploitation; and (2) high-privilege authentication - the attacker must possess valid administrator credentials for the router's web management interface (PR:H per the CVSS 4.0 vector). The vulnerability is specifically triggered through the HTTP-WRITEOEM handler, an OEM flash-write endpoint not exposed to unauthenticated users. What limits exploitation is the combination of required admin credentials and local network presence; an unauthenticated remote attacker cannot reach this endpoint without first compromising credentials and gaining LAN access. The vulnerability does not require any special non-default configuration to be present beyond the device running an affected firmware version.

The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N scores 6.8 (Medium), accurately capturing the constrained threat model: exploitation requires adjacent network positioning (LAN or WLAN, not the open internet) and high-privilege authentication (router administrator credentials). Impact is limited entirely to availability - there is no confidentiality or integrity exposure. No EPSS data was provided, the vulnerability does not appear in CISA KEV, and no public proof-of-concept has been identified. Real-world risk is therefore materially lower than the CVSS numeric score alone might suggest; the threat is primarily from malicious insiders, post-compromise lateral movement, or credential-reuse scenarios rather than opportunistic internet-facing attacks. The CVSS adjacent-vector designation is consistent with the description - this is not remotely exploitable from the internet without first gaining LAN access and admin credentials.

An attacker who has obtained router administrator credentials - via credential reuse, phishing, or a prior compromise - and who is present on the same LAN or WLAN as the Archer A6 V4 authenticates to the web management interface, then sends a crafted HTTP request targeting the WRITEOEM handler with malformed input. The flash-write logic processes the unsanitized data, causing the httpd daemon or the router itself to crash and making the web management interface unavailable until the device reboots. No public proof-of-concept code has been identified at time of analysis.