RCE in Tp Link Systems Inc. Tl-wr840n V6
CVE-2026-3227
A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an auth…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.003 (54.5th percentile) — read the EPSS interpretation.
Affected products
- Tp Link Systems Inc. Tl-wr840n V6 — versions 0
- Tp-link Systems Inc. Tl-wr802n V4 — versions 0
- Tp-link Systems Inc. Tl-wr841n V14 — versions 0
Weakness classification (CWE)
References
- www.tp-link.com/en/support/download/tl-wr802n/v4/ (patch)
- www.tp-link.com/us/support/download/tl-wr802n/v4/ (patch)
- www.tp-link.com/en/support/download/tl-wr841n/v14/ (patch)
- www.tp-link.com/us/support/download/tl-wr841n/v14/ (patch)
- www.tp-link.com/en/support/download/tl-wr840n/v6/ (patch)
- www.tp-link.com/us/support/faq/5018/ (vendor-advisory)