CVE-2026-109683— UPnP Newline Injection Vulnerability in TP-Link Archer BE805

Quick assessment

Affected

TP-Link Systems Inc. Archer BE805 v1

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Archer BE805 v1 的 UPnP 服务中存在换行符注入漏洞。由于缺乏适当的输入过滤，邻近攻击者可在 UPnP 端口映射描述中注入换行符，导致意外内容被注入到 UPnP 端口映射数据中。成功利用该漏洞后，局域网内的未认证攻击者可能修改运行时 UPnP 端口映射信息，并在受影响的服务中创建伪造的映射条目。该问题仅限于 UPnP 映射数据的完整性，未表现出代码执行或权限提升的风险。

CVSS 5.3 · Medium EPSS 0.31% · P24 Updated Nov 07, 2026

Possible ATT&CK Techniques 2 AI

T1573 · Encrypted Channel T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
TP-Link Systems Inc.	Archer BE805 v1	`< V1.6_1.5.1 Build 261102`	affected
		`< V1.20_1.5.1 Build 261102`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

UPnP Newline Injection Vulnerability in TP-Link Archer BE805

Source: CVE Program / CVE List V5

Vulnerability Description

A newline injection vulnerability exists in the UPnP service of Archer BE805 v1 such that an adjacent attacker can supply newline characters in a UPnP port-mapping description due to improper sanitization, resulting in possible injection of unintended content into UPnP port-mapping data. Successful exploitation may allow an unauthenticated attacker on the local network to modify runtime UPnP port-mapping information and create spoofed entries within the affected service. The issue is limited to the integrity of UPnP mapping data and does not demonstrate code execution or privilege escalation.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

对CRLF序列的转义处理不恰当(CRLF注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
TP-Link Systems Inc.	Archer BE805 v1	0 ~ V1.6_1.5.1 Build 261102	-

II. Public POCs for CVE-2026-109683

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-109683

请登录查看更多情报信息。

Vendor Pages for CVE-2026-109683 (3)

https://www.cve.org/CVERecord?id=CVE-2026-109683

IV. Related Vulnerabilities

Same vendor: TP-Link Systems Inc.

Same weakness: CWE-93