{"id":"CVE-2026-15428","aliases":["EUVD-2026-43963","GHSA-fxq7-2872-5xg8"],"status":"published","title":"OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v","description":"An OS\ncommand injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of\nthe domain name parameter. An adjacent attacker who can access the relevant\nHTTP interface can modify the parameter to inject shell metacharacters, resulting\nin arbitrary code execution with root privileges.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow remote code execution and complete compromise of the\ndevice.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02083,"percentile":0.81683,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-07-14T17:03:33Z","modified":"2026-10-24T21:10:00Z","products":[{"vendor":"tp-link","product":"archer_vx1800v_firmware"},{"vendor":"tp-link systems inc.","product":"archer vx1800v v1"}],"references":[{"url":"https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware","tags":["patch","Product"]},{"url":"https://www.tp-link.com/us/support/faq/5189/","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15428"},{"url":"https://www.tp-link.com/us/support/faq/5189"},{"url":"https://github.com/advisories/GHSA-fxq7-2872-5xg8"}],"sources":{"cve":[{"id":"CVE-2026-15428","title":"OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v","description":"An OS\ncommand injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of\nthe domain name parameter. An adjacent attacker who can access the relevant\nHTTP interface can modify the parameter to inject shell metacharacters, resulting\nin arbitrary code execution with root privileges.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow remote code execution and complete compromise of the\ndevice.","status":"published","published":"2026-07-14T17:03:33.853Z","modified":"2026-07-15T03:59:51.416Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-43963","description":"An OS\ncommand injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of\nthe domain name parameter. An adjacent attacker who can access the relevant\nHTTP interface can modify the parameter to inject shell metacharacters, resulting\nin arbitrary code execution with root privileges.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow remote code execution and complete compromise of the\ndevice.","status":"published","published":"2026-07-14T17:03:33Z","modified":"2026-07-15T03:59:51Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:19:53.678292Z"}],"ghsa":[{"id":"GHSA-fxq7-2872-5xg8","title":"An OS\ncommand injection vulnerability exists in Archer VX800v v1 due to insufficient input...","description":"An OS\ncommand injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of\nthe domain name parameter. An adjacent attacker who can access the relevant\nHTTP interface can modify the parameter to inject shell metacharacters, resulting\nin arbitrary code execution with root privileges.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow remote code execution and complete compromise of the\ndevice.","status":"published","published":"2026-07-14T18:31:56Z","modified":"2026-08-06T18:31:32Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:10:10.387883Z"}],"nvd":[{"id":"CVE-2026-15428","description":"An OS\ncommand injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of\nthe domain name parameter. An adjacent attacker who can access the relevant\nHTTP interface can modify the parameter to inject shell metacharacters, resulting\nin arbitrary code execution with root privileges.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow remote code execution and complete compromise of the\ndevice.","status":"published","published":"2026-07-14T17:16:44.79Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:29.114188Z"}]}}