RCE in Tp-link Systems Inc. Tl-wr940n V6
CVE-2026-11410
An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to exe…
Vulnerability class: Command Injection (OS Command Injection)
Affected products
- Tp-link Systems Inc. Tl-wr940n V6 — versions 0
Weakness classification (CWE)
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory)