Riskcovery

CVE-2026-102294

Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration

State
Published
Severity
8.5 High
Published
Oct 1, 2026
Updated
Oct 2, 2026
Reserved
Sep 28, 2026

Read the record on cve.org

Description

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands.

Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration or services, and disruption of device operation.

Scores

CVSSScoreVectorSource
4.08.5 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NTPLink

Weaknesses

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

ProductVersions
TL-WR841N v14TP-Link System Inc.
  • before 4.19 Build 260821 (EN)Affected
  • before 4.19 Build 260820 (US)Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.