Vulnerability · Published Aug 24, 2026 · Assigned by TPLink
CVE-2026-9254Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices
High 8.7
In plain English
A high-severity OS command injection in Archer AX75 V1 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges. Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | Archer BE800 V1 | 0 – before 1.4.2 Build 260708 |
| TP-Link Systems Inc. | Archer BE3600 V1 | 0 – before 1.2.6 Build 20260617 |
| TP-Link Systems Inc. | Archer AX75 V1 | 0 – before 1.1.6 Build 260716 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
References
- https://www.tp-link.com/en/support/download/archer-be800/v1/#Firmware patch
- https://www.tp-link.com/us/support/download/archer-be800/v1/#Firmware patch
- https://www.tp-link.com/en/support/download/archer-be3600/v1/#Firmware patch
- https://www.tp-link.com/us/support/download/archer-be3600/v1/#Firmware patch
- https://www.tp-link.com/kr/support/download/archer-be3600/v1/#Firmware patch
- https://www.tp-link.com/en/support/download/archer-ax75/v1/#Firmware patch
- https://www.tp-link.com/us/support/download/archer-ax75/v1/#Firmware patch
- https://www.tp-link.com/us/support/faq/5264/ vendor-advisory