Improper input validation in TP-Link Systems Inc. Archer A6 V4

CVE-2026-9031

An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web interface and a denial-of-service condition.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.002 (5.9th percentile) — read the EPSS interpretation.