What’s Vulnerable › Vulnerabilities

CVE-2026-15428: OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-78

Description

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges. Successful exploitation may allow remote code execution and complete compromise of the device.

Affected products

• TP-Link Systems Inc. Archer VX1800v v1: before 0.16.0; 2.0.0 — fixed in 0.16.0

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. Archer VX1800v v1 0.16.0. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware
• https://www.tp-link.com/us/support/faq/5189/

Get alerted when CVE-2026-15428 or the next vulnerability affects your stack