TP-Link TL-WR841N EUVD-2026-90974

Exploitation requires: (1) an authenticated administrator session on the device (PR:H) - this is a post-authentication flaw, not remotely triggerable by an anonymous attacker; (2) adjacent network access to the router's web management interface (AV:A), i.e. presence on the LAN or Wi-Fi segment rather than arbitrary internet reach; and (3) submission of a crafted IPv6 Gateway value through the IPv6 WAN configuration feature. The specific prerequisite condition is that an attacker-controlled IPv6 Gateway string is incorporated into a system command. Limiting factors that reduce realistic risk: the administrator-credential requirement, the adjacent-only vector, and the need to interact with the IPv6 WAN configuration page. No special non-default configuration is required beyond access to that configuration feature.

This is a real but context-limited risk. The CVSS 4.0 base score of 8.5 (High) is driven by full VC:H/VI:H/VA:H impact - unsurprising, since OS command injection (CWE-78) on an embedded router yields complete device compromise. However, two metrics materially constrain real-world severity: AV:A (adjacent, not network) means the attacker must reach the device's management plane (LAN/Wi-Fi segment, not arbitrary internet-based reach), and PR:H means a valid administrator session is required - this is a privilege-escalation/post-authentication issue, not a pre-auth takeover. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable exploitation. Contrast this with the signals: high technical impact but high privilege requirement and adjacent-only vector place this below internet-facing pre-auth flaws in prioritization. Note a tag inconsistency - the input is tagged 'Authentication Bypass,' which conflicts with the description and the PR:H vector; this is authenticated command injection, NOT an authentication bypass, and the tag should not drive triage decisions. Patch is vendor-confirmed, so remediation is straightforward.

An attacker who already holds administrator credentials (or has hijacked an authenticated admin session via CSRF/credential reuse on the LAN/Wi-Fi) navigates to the IPv6 WAN configuration page and submits a crafted IPv6 Gateway value containing shell metacharacters. Because the value is passed unsanitized into a system command, the attacker gains arbitrary OS command execution on the router. No public exploit code was identified at time of analysis.