What’s Vulnerable › Vulnerabilities

CVE-2026-102294: Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration

• Severity: high (CVSS 8.5 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-02
• Weakness: CWE-78

Description

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands.  Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration or services, and disruption of device operation.

Affected products

• TP-Link System Inc. TL-WR841N v14: before 4.19 Build 260821 (EN); before 4.19 Build 260820 (US) — fixed in 4.19 Build 260820 (US), 4.19 Build 260821 (EN)

How to fix

Upgrade to a fixed version: TP-Link System Inc. TL-WR841N v14 4.19 Build 260820 (US), 4.19 Build 260821 (EN). Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/tl-wr841n/v14/#Firmware
• https://www.tp-link.com/us/support/download/tl-wr841n/v14/#Firmware
• https://www.tp-link.com/us/support/faq/5320/

Get alerted when CVE-2026-102294 or the next vulnerability affects your stack