Skip to main content

TP-Link Archer CVE-2026-9254

| EUVDEUVD-2026-65006 HIGH
OS Command Injection (CWE-78)
2026-08-24 TPLink GHSA-3h97-6772-mpj4
Command Injection Archer Be800 V1 Archer Be3600 V1 Archer Ax75 V1
8.7
CVSS 4.0 · Vendor: TPLink
Share

Severity by source

Vendor (TPLink) PRIMARY
8.7 HIGH
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.6 CRITICAL

Adjacent-only vector (LAN-required); no auth or complexity barriers; scope changes because root compromise on the router exposes all downstream LAN hosts.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 24, 2026 - 18:16 vuln.today
CVE Published
Aug 24, 2026 - 17:25 cve.org
HIGH 8.7

DescriptionCVE.org

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges.

Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.

AnalysisAI

Unauthenticated OS command injection in TP-Link Archer BE800 V1, BE3600 V1, and AX75 V1 routers allows any LAN-adjacent attacker to execute arbitrary commands with root privileges via the parental control subsystem. Exploitation requires no credentials and no user interaction, resulting in complete device compromise including full control over routing, firewall policy, and all traffic transiting the device. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain LAN or Wi-Fi network adjacency
Delivery
Send crafted HTTP request to parental control endpoint
Exploit
Inject shell metacharacters in vulnerable parameter
Execution
Router daemon passes input unsanitized to shell interpreter
Persist
Attacker commands execute as root
Impact
Establish persistent access or intercept network traffic
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires LAN-adjacent network access - the attacker must be on the same wired or wireless network segment as the router (e.g., connected to the router's LAN ports or associated with its Wi-Fi SSID, including any guest networks bridged to the LAN). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 with AV:A correctly captures the single meaningful constraint: the attacker must be LAN-adjacent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker connected to the target network - via a compromised wireless client, a rogue device on a shared Wi-Fi segment, or direct wired LAN access - crafts an HTTP request to the router's parental control endpoint, embedding shell metacharacters in a vulnerable parameter. The router's parental control process passes the unsanitized input directly to the underlying shell, executing the attacker's commands as root. …
Remediation The primary fix is to update router firmware to the patched releases: Archer BE800 V1 to firmware 1.4.2 Build 260708 or later (https://www.tp-link.com/en/support/download/archer-be800/v1/#Firmware), Archer BE3600 V1 to 1.2.6 Build 20260617 or later (https://www.tp-link.com/en/support/download/archer-be3600/v1/#Firmware), and Archer AX75 V1 to 1.1.6 Build 260716 or later (https://www.tp-link.com/en/support/download/archer-ax75/v1/#Firmware); refer to the vendor advisory at https://www.tp-link.com/us/support/faq/5264/ for full guidance. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all TP-Link Archer BE800 V1, BE3600 V1, and AX75 V1 deployments using asset management tools and network scanning. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Archer Be800 V1

View all
CVE-2026-16348 HIGH
8.5 Aug 24

Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an auth

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-9254 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy