Riskcovery

CVE-2026-75616

Command Injection in Router Web Management Interface

State
Published
Severity
8.5 High
Published
Aug 19, 2026
Updated
Aug 20, 2026
Reserved
Aug 17, 2026

Read the record on cve.org

Description

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise.

Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it.

Scores

CVSSScoreVectorSource
4.08.5 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NTPLink

Weaknesses

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

ProductVersions
Archer C20 v6TP-Link Systems Inc.
  • before EU_0.9.1 Build 260811Affected
  • before US_0.9.1 Build 260812Affected
  • before RU_0.9.1 Build 260812Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.