Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118865— Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component

Quick assessment

Affected
TP-Link Systems Inc. Archer AX3000 v2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Archer AX3000 v2 的“离线下载”组件（USB 存储分配功能）中存在一个已认证的操作系统命令注入漏洞。当连接 USB 存储设备时，已认证的管理员可提交包含 shell 元字符的构造路径值；该值在传递给系统命令前未得到正确中和。 成功利用此漏洞可能导致在受影响设备上执行任意命令。

CVSS 7.3 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118865

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component
Source: CVE Program / CVE List V5
Vulnerability Description
An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command.  Successful exploitation may allow arbitrary command execution on the affected device.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
TP-Link Systems Inc. Archer AX3000 v2 0 ~ 1.1.3 Build 261026 -

II. Public POCs for CVE-2026-118865

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118865

请登录查看更多情报信息。

Other References for CVE-2026-118865 (2)

Same Patch Batch · TP-Link Systems Inc. · 2026-11-03 · 3 CVEs total

CVE-2026-105821 8.3 HIGH Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy
CVE-2026-105822 8.3 HIGH Server-Side Request Forgery in Tapo Cloud MQTT Proxy

IV. Related Vulnerabilities

Same vendor: TP-Link Systems Inc.
Same weakness: CWE-78