Vulnerability · Published Mar 13, 2026 · Assigned by TPLink

CVE-2026-3227Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N

High 8.5

In plain English

A high-severity OS command injection in TL-WR802N v4 from TP-Link Systems Inc.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)1.9%top 20.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	TL-WR802N v4	0 – before V4_260304
TP-Link Systems Inc.	TL-WR841N v14	0 – before V14_260303
TP Link Systems Inc.	TL-WR840N v6	0 – before V6_260304

Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References