What’s Vulnerable › Vulnerabilities

CVE-2026-8913: Command Injection in TP-Link's Archer MR600 WireGuard Client Configuration

• Severity: high (CVSS 8.5 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-08 · updated 2026-07-23
• Weakness: CWE-78

Description

A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.

Affected products

• TP-Link Systems Inc. Archer MR600 v5: before EU_V5_1.7.0 0.9.1 260518 rel67803; before JP_V5_1.2.0 0.9.1 260519 rel52362 — fixed in EU_V5_1.7.0 0.9.1 260518 rel67803, JP_V5_1.2.0 0.9.1 260519 rel52362

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. Archer MR600 v5 EU_V5_1.7.0 0.9.1 260518 rel67803, JP_V5_1.2.0 0.9.1 260519 rel52362. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware
• https://www.tp-link.com/jp/support/download/archer-mr600/v5/#Firmware
• https://www.tp-link.com/us/support/faq/5122/

Get alerted when CVE-2026-8913 or the next vulnerability affects your stack