Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-9254— Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices

Quick assessment

Affected
TP-Link Systems Inc. Archer BE800 V1
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Archer BE800 V1、BE3600 V1 和 AX75 V1 的家长控制功能中存在未认证的操作系统命令注入漏洞，原因是某些参数中对特殊字符的处理和过滤不当。基于局域网的攻击者可以注入任意命令，并以 root 权限执行这些命令。 成功利用该漏洞可能导致设备完全被攻破，并影响受影响设备及网络流量的机密性、完整性和可用性。

CVSS 8.7 · High EPSS 2.35% · P82

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

VendorProduct Version RangeStatus
TP-Link Systems Inc. Archer AX75 V1 < 1.1.6 Build 260716 affected
TP-Link Systems Inc. Archer BE3600 V1 < 1.2.6 Build 20260617 affected
TP-Link Systems Inc. Archer BE800 V1 < 1.4.2 Build 260708 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-9254

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices
Source: CVE Program / CVE List V5
Vulnerability Description
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges. Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
TP-Link Systems Inc. Archer BE800 V1 0 ~ 1.4.2 Build 260708 -
TP-Link Systems Inc. Archer BE3600 V1 0 ~ 1.2.6 Build 20260617 -
TP-Link Systems Inc. Archer AX75 V1 0 ~ 1.1.6 Build 260716 -

II. Public POCs for CVE-2026-9254

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9254

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-9254 (1)

Vendor Pages for CVE-2026-9254 (4)

Other References for CVE-2026-9254 (1)

Same Patch Batch · TP-Link Systems Inc. · 2026-08-24 · 4 CVEs total

CVE-2026-16348 8.5 HIGH Command Injection Vulnerability in VPN connection of Archer BE800
CVE-2026-78541 8.5 HIGH Command Injection in Parent Control of TP-Link Archer BE3600 v1
CVE-2026-15469 7.7 HIGH Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800

IV. Related Vulnerabilities

Same product: Archer BE800 V1
Same vendor: TP-Link Systems Inc.
Same weakness: CWE-78

V. Comments for CVE-2026-9254

No comments yet

Leave a comment