Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2026-8913

Command Injection in TP-Link's Archer MR600 WireGuard Client Configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TPLink

Description

A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TP-Link Systems Inc. Archer MR600 v5

Default version status: unaffected

  • 0 to < EU_V5_1.7.0 0.9.1 260518 rel67803affected
  • 0 to < JP_V5_1.2.0 0.9.1 260519 rel52362affected

References