CVE-2026-15428

Katalog CVE

CVSS 8.8 · High EPSS 2,1%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada tp-link archer vx1800v firmware. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges. Successful exploitation may allow remote code execution and complete compromise of the device.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tp-link.com/us/support/faq/5189/ advisory vendor
• https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware product