What’s Vulnerable › Vulnerabilities

CVE-2026-9030: Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6

• Severity: medium (CVSS 6.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-07 · updated 2026-10-24
• Weakness: CWE-362

Description

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations.  By sending crafted systool instructions through the asynchronous request path, successful exploitation may cause the httpd process or device management service to crash and may result in temporary loss of access to the web management interface or device reboot.

Affected products

• TP-Link Systems Inc. Archer A6 v4: before V4_1.15.10 Build 260625 Rel.25447 — fixed in V4_1.15.10 Build 260625 Rel.25447

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. Archer A6 v4 V4_1.15.10 Build 260625 Rel.25447. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/archer-a6/v4/#Firmware
• https://www.tp-link.com/en/support/faq/5234/
• https://www.tp-link.com/us/support/download/archer-a6/v4/#Firmware

Get alerted when CVE-2026-9030 or the next vulnerability affects your stack