TP-Link Archer AX3000 EUVD-2026-116533

Exploitation requires all of the following: adjacent-network reach to the router's authenticated management interface (AV:A); valid administrator credentials (PR:H); a USB storage device physically attached to the device; and use of the Offline Download component's USB storage allocation function, into which a crafted path containing shell metacharacters is submitted. The limiting factors that reduce real-world risk are the administrator authentication requirement, the need for an attached USB device (the AT:P attack requirement), and the adjacent-network constraint rather than direct internet exposure; the specific trigger beyond 'path value containing shell metacharacters not properly neutralized' is as described in the source and no further detail on the exact parameter is provided.

This is a moderate-severity, high-barrier issue rather than a drop-everything emergency. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:H/UI:N, VC:H/VI:H/VA:H, base 7.3) shows the most important limiters clearly: exploitation requires adjacent-network access (AV:A, not full internet-facing AV:N), high privileges - i.e. an authenticated administrator (PR:H) - and an attack requirement (AT:P), which aligns with the description's precondition that a USB storage device must be attached. In exchange the attacker gets full high impact to confidentiality, integrity and availability (arbitrary command execution on the device). There is no EPSS score in the input, the CVE is not listed in CISA KEV, and no PoC or exploit reference is present (the only references are TP-Link firmware/FAQ pages), so by the input signals this is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', consistent with a real but not critical priority. The signals are mutually consistent - none conflict - and the combination of required admin authentication plus adjacent access plus an attached USB device keeps real-world mass-exploitation risk low despite the high technical impact. Missing data to note: no EPSS, no SSVC automatable/exploitation values, and no CVSS 3.1 vector were provided.

An attacker who already holds administrator credentials for an Archer AX3000 v2 (or who reaches the authenticated admin interface over the adjacent/local network) and has a USB storage device attached to the router submits a path value in the Offline Download / USB storage allocation function containing shell metacharacters. Because the value is not neutralized before being passed to a system command, the injected command runs on the device, yielding arbitrary command execution. No public exploit code is identified in the provided data, so this would currently require attacker-developed tooling.