CVE-2026-8913

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8913", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-05-18T23:12:55.471Z", "datePublished": "2026-06-08T17:21:45.936Z", "dateUpdated": "2026-11-05T01:03:34.951Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-11-05T01:03:34.951Z"}, "title": "Command Injection in Archer MR600 WireGuard Client Configuration", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Archer MR600 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "EU_V5_1.7.0 0.9.1 260518 rel67803", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "JP_V5_1.2.0 0.9.1 260519 rel52362", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer MR600 v2", "versions": [{"status": "affected", "version": "0", "lessThan": "1.12.0 Build 260826", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer MR600 v3", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.0 Build 260827", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.<div>Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.</div>"}]}], "references": [{"url": "https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/jp/support/download/archer-mr600/v5/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5122/", "tags": ["vendor-advisory"]}, {"url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-mr600/v3/#Firmware", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Akira Moroo (Ricerca Security, Inc.), Satoki Tsuji (Ricerca Security, Inc.), Anonymous", "type": "finder"}, {"lang": "en", "value": "Jason Tang (Neonix Security)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-8913"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T03:55:38.204Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8913", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-08T18:24:44.862937Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T18:24:51.494Z"}}], "cna": {"title": "Command Injection in Archer MR600 WireGuard Client Configuration", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Akira Moroo (Ricerca Security, Inc.), Satoki Tsuji (Ricerca Security, Inc.), Anonymous"}, {"lang": "en", "type": "finder", "value": "Jason Tang (Neonix Security)"}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Archer MR600 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "EU_V5_1.7.0 0.9.1 260518 rel67803", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "JP_V5_1.2.0 0.9.1 260519 rel52362", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer MR600 v2", "versions": [{"status": "affected", "version": "0", "lessThan": "1.12.0 Build 260826", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer MR600 v3", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.0 Build 260827", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/jp/support/download/archer-mr600/v5/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5122/", "tags": ["vendor-advisory"]}, {"url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-mr600/v3/#Firmware", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.", "supportingMedia": [{"type": "text/html", "value": "A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.<div>Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-11-05T01:03:34.951Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8913", "state": "PUBLISHED", "dateUpdated": "2026-11-05T01:03:34.951Z", "dateReserved": "2026-05-18T23:12:55.471Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-06-08T17:21:45.936Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Archer MR600 v5", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "EU_V5_1.7.0 0.9.1 260518 rel67803", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "JP_V5_1.2.0 0.9.1 260519 rel52362", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Archer MR600 v2", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.12.0 Build 260826", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Archer MR600 v3", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.4.0 Build 260827", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos existe en la configuraci\u00f3n del cliente WireGuard de Archer MR600 v5 debido a la neutralizaci\u00f3n inadecuada de la entrada controlada por el usuario dentro de la interfaz de gesti\u00f3n web. Un atacante autenticado con privilegios administrativos podr\u00eda ejecutar comandos arbitrarios al aplicar cambios de configuraci\u00f3n. La explotaci\u00f3n exitosa podr\u00eda resultar en un compromiso total de la confidencialidad, integridad y disponibilidad del dispositivo afectado."}], "id": "CVE-2026-8913", "lastModified": "2026-11-03T20:18:19.353", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8913", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-06-08T18:16:34.177", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/archer-mr600/v3/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/jp/support/download/archer-mr600/v5/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/faq/5122/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,EU_V5_1.7.0 0.9.1 260518 rel67803)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,JP_V5_1.2.0 0.9.1 260519 rel52362)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer MR600 v5", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_mr600", "vendor": "tp-link"}], "created": "2026-06-08T19:30:06.567254+00:00", "updated": "2026-11-04T15:15:15.465561+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$archer_mr600"]}