TP-Link Archer CVE-2026-9254

Exploitation requires LAN-adjacent network access - the attacker must be on the same wired or wireless network segment as the router (e.g., connected to the router's LAN ports or associated with its Wi-Fi SSID, including any guest networks bridged to the LAN). The parental control feature must be present on the device, which it is by default in all affected firmware versions - no special configuration is required to expose the vulnerable endpoint. No authentication credentials are required; the vulnerability is exploitable pre-authentication per the CVSS 4.0 vector (PR:N). No user interaction on any connected device is needed. Limiting factors: the attack vector is strictly adjacent (AV:A) - the router's vulnerable interface is not exposed to the internet under normal configurations, so remote exploitation from the WAN is not possible without an additional misconfiguration such as port forwarding of the LAN management interface. Only devices running firmware versions below the fixed builds are affected.

The CVSS 4.0 score of 8.7 with AV:A correctly captures the single meaningful constraint: the attacker must be LAN-adjacent. Within that constraint, every other metric is maximally permissive - no authentication, no complexity, no user interaction - making exploitation mechanically trivial for any attacker who achieves network adjacency. The adjacency requirement is less protective than it appears in practice: any device already on the LAN (a compromised IoT appliance, a guest Wi-Fi client, or a rogue device plugged into an open port) qualifies as the attack origin. The secondary-system impact (SC:L/SI:L/SA:L in the provided CVSS 4.0 vector) reflects that all network traffic routed through the device is also at risk, extending the blast radius to downstream LAN hosts. No EPSS data was supplied, and the CVE is absent from the CISA KEV catalogue, so active widespread exploitation is not confirmed - however, the complete absence of prerequisites within the LAN means the technical barrier is extremely low. SSVC signals: exploitation is not confirmed as automated or weaponized, but technical impact is 'total' (root-level device compromise) and the attack is potentially automatable across an entire subnet. Vendor patches exist and are specific to fixed firmware builds, making remediation straightforward for asset owners who apply firmware updates routinely.

An attacker connected to the target network - via a compromised wireless client, a rogue device on a shared Wi-Fi segment, or direct wired LAN access - crafts an HTTP request to the router's parental control endpoint, embedding shell metacharacters in a vulnerable parameter. The router's parental control process passes the unsanitized input directly to the underlying shell, executing the attacker's commands as root. With root access, the attacker can install a persistent backdoor in flash storage, intercept and manipulate all traversing network traffic, or use the router as a pivot point to attack other LAN hosts. No public proof-of-concept has been identified at time of analysis.