TP-Link Archer C20 EUVD-2026-63081

Exploitation requires two concrete preconditions: (1) the attacker must have network-layer adjacency to the Archer C20 v6 web management interface - typically the LAN segment, or the WAN if remote management is explicitly enabled by the device owner; and (2) the attacker must possess valid administrator-level credentials for the device (CVSS PR:H). The vulnerable code path is triggered specifically through WAN-related configuration operations within the management UI; other interface areas are not confirmed vulnerable. Exploitation is blocked for unauthenticated remote attackers. The effective barrier is substantially lowered when default credentials remain unchanged or when device passwords are reused across accounts. Remote management being disabled on the WAN interface confines potential attackers to the local network segment.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N) yields a score of 8.5, which accurately reflects two substantive mitigating factors: adjacency requirement and high-privilege prerequisite. These factors meaningfully narrow the exploitable population compared to network-reachable, unauthenticated flaws. No EPSS score is available for this CVE, and the absence of a KEV listing combined with no reported public exploit code suggests opportunistic mass exploitation is unlikely at time of analysis. The realistic threat model centers on an insider or an attacker who has already compromised administrator credentials through credential stuffing, phishing, or default-credential abuse - all of which are common in the SOHO router segment. The full CIA impact metrics (VC:H/VI:H/VA:H) are realistic once the access bar is cleared, as router-level command execution can intercept or manipulate all passing traffic. The combination of AV:A and PR:H keeps this below the threshold of a widespread automated threat, but organizations managing fleets of SOHO or branch-office routers should still treat patching as urgent given the frequency of credential reuse in this device class.

An attacker who has obtained valid Archer C20 v6 administrator credentials - through default credential abuse, credential reuse, or phishing the device owner - connects to the web management interface from the local network and navigates to a WAN configuration function. By submitting a parameter value containing OS command metacharacters (e.g., semicolons or backticks), the attacker causes the firmware to execute attacker-supplied shell commands with elevated privileges, enabling persistent backdoor installation, traffic interception, or full device reconfiguration.