RCE in Tp-link Tl-wr802n
CVE-2026-3227
A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an auth…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.011 (62.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Tp-link Tl-wr802n — versions v4
- Tp-link Tl-wr802n_firmware
- Tp-link Tl-wr840n — versions 6
- Tp-link Tl-wr840n_firmware
- Tp-link Tl-wr841n — versions 14
- Tp-link Tl-wr841n_firmware
- Tp Link Systems Inc. Tl-wr840n V6 — versions 0
- Tp-link Systems Inc. Tl-wr802n V4 — versions 0
- Tp-link Systems Inc. Tl-wr841n V14 — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-3227?
- CVE-2026-3227 is a medium-severity vulnerability in Tp-link Tl-wr802n, classified under OS Command Injection. CVSS score: 6.8/10. Published 2026-03-16.
- How severe is CVE-2026-3227?
- Medium severity. CVSS v3 base score is 6.8 out of 10.
- Is CVE-2026-3227 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.