Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-9254— Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices

Quick assessment

Affected
TP-Link Systems Inc. Archer BE800 V1
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

TP-Link Archer BE800 V1是中国TP-Link公司的一款高性能无线路由器。 TP-Link Archer BE800 V1 1.4.2 Build 260708之前版本存在命令注入漏洞，该漏洞源于对某些参数中的特殊字符过滤和中和不当，可能导致未经身份验证的局域网攻击者注入任意命令并以root权限执行，造成设备完全受损，影响设备及网络流量的机密性、完整性和可用性。

CVSS 8.7 · High EPSS 3.06% · P87

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

VendorProduct Version RangeStatus
TP-Link Systems Inc. Archer AX75 V1 < 1.1.6 Build 260716 affected
TP-Link Systems Inc. Archer BE3600 V1 < 1.2.6 Build 20260617 affected
TP-Link Systems Inc. Archer BE800 V1 < 1.4.2 Build 260708 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-9254

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices
Source: CVE Program / CVE List V5
Vulnerability Description
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges. Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
TP-Link Archer BE800 V1 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TP-Link Archer BE800 V1是中国TP-Link公司的一款高性能无线路由器。 TP-Link Archer BE800 V1 1.4.2 Build 260708之前版本存在命令注入漏洞，该漏洞源于对某些参数中的特殊字符过滤和中和不当，可能导致未经身份验证的局域网攻击者注入任意命令并以root权限执行，造成设备完全受损，影响设备及网络流量的机密性、完整性和可用性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
TP-Link Systems Inc. Archer BE800 V1 0 ~ 1.4.2 Build 260708 -
TP-Link Systems Inc. Archer BE3600 V1 0 ~ 1.2.6 Build 20260617 -
TP-Link Systems Inc. Archer AX75 V1 0 ~ 1.1.6 Build 260716 -

II. Public POCs for CVE-2026-9254

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9254

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-9254 (1)

Vendor Pages for CVE-2026-9254 (4)

Other References for CVE-2026-9254 (1)

Same Patch Batch · TP-Link Systems Inc. · 2026-08-24 · 4 CVEs total

CVE-2026-16348 8.5 HIGH Command Injection Vulnerability in VPN connection of Archer BE800
CVE-2026-78541 8.5 HIGH Command Injection in Parent Control of TP-Link Archer BE3600 v1
CVE-2026-15469 7.7 HIGH Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800

IV. Related Vulnerabilities

Same product: Archer BE800 V1
Same vendor: TP-Link Systems Inc.
Same weakness: CWE-78