Vulnerability · Published Jun 8, 2026 · Assigned by TPLink
CVE-2026-8913Command Injection in Archer MR600 WireGuard Client Configuration
High 8.5
In plain English
A high-severity OS command injection in Archer MR600 v2 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Official description
A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | Archer MR600 v5 | 0 – before EU_V5_1.7.0 0.9.1 260518 rel678030 – before JP_V5_1.2.0 0.9.1 260519 rel52362 |
| TP-Link Systems Inc. | Archer MR600 v2 | 0 – before 1.12.0 Build 260826 |
| TP-Link Systems Inc. | Archer MR600 v3 | 0 – before 1.4.0 Build 260827 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware patch
- https://www.tp-link.com/jp/support/download/archer-mr600/v5/#Firmware patch
- https://www.tp-link.com/us/support/faq/5122/ vendor-advisory
- https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware patch
- https://www.tp-link.com/en/support/download/archer-mr600/v3/#Firmware patch