Vulnerability · Published Jul 14, 2026 · Assigned by TPLink

CVE-2026-15428OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

High 8.5

In plain English

A high-severity OS command injection in Archer VX1800v v1 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)2.1%top 18.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges. Successful exploitation may allow remote code execution and complete compromise of the device.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	Archer VX1800v v1	0 – before 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n

Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware patch
https://www.tp-link.com/us/support/faq/5189/ vendor-advisory