Vulnerability · Published Aug 7, 2026 · Assigned by TPLink
CVE-2026-9030Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6
Medium 6.8
In plain English
A medium-severity race condition in Archer A6 v4 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path, successful exploitation may cause the httpd process or device management service to crash and may result in temporary loss of access to the web management interface or device reboot.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | Archer A6 v4 | 0 – before V4_1.15.10 Build 260625 Rel.25447 |
Weakness: CWE-362 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N