CVE-2026-15428

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges. Successful exploitation may allow remote code execution and complete compromise of the device.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware	Product
https://www.tp-link.com/us/support/faq/5189/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:tp-link:archer_vx1800v_firmware::::::::
	cpe:2.3:o:tp-link:archer_vx1800v_firmware:2.0.0:::::::*

cpe:2.3:h:tp-link:archer_vx1800v:1.0:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección de comandos del sistema operativo (OS) existe en Archer VX800v v1 debido a una sanitización de entrada insuficiente del parámetro de nombre de dominio. Un atacante adyacente que puede acceder a la interfaz HTTP relevante puede modificar el parámetro para inyectar metacaracteres de shell, lo que resulta en ejecución de código arbitrario con privilegios de root. La explotación exitosa puede permitir la ejecución remota de código y el compromiso completo del dispositivo.

Information

Published : 2026-07-14 17:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-15428

Mitre link : CVE-2026-15428

CVE.ORG link : CVE-2026-15428

JSON object : View

Products Affected

tp-link

archer_vx1800v_firmware
archer_vx1800v

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-15428", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15428", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "Archer VX1800v v1", "versions": [{"status": "affected", "version": "0", "lessThan": "0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T17:16:44.790", "references": [{"url": "https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5189/", "tags": ["Vendor Advisory"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An OS\ncommand injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of\nthe domain name parameter. An adjacent attacker who can access the relevant\nHTTP interface can modify the parameter to inject shell metacharacters, resulting\nin arbitrary code execution with root privileges.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow remote code execution and complete compromise of the\ndevice."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo (OS) existe en Archer VX800v v1 debido a una sanitizaci\u00f3n de entrada insuficiente del par\u00e1metro de nombre de dominio. Un atacante adyacente que puede acceder a la interfaz HTTP relevante puede modificar el par\u00e1metro para inyectar metacaracteres de shell, lo que resulta en ejecuci\u00f3n de c\u00f3digo arbitrario con privilegios de root.\n\nLa explotaci\u00f3n exitosa puede permitir la ejecuci\u00f3n remota de c\u00f3digo y el compromiso completo del dispositivo."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_vx1800v_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03B92A44-2879-474C-AD7E-4917B95EDC3A", "versionEndExcluding": "0.16.0"}, {"criteria": "cpe:2.3:o:tp-link:archer_vx1800v_firmware:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC7661D9-BA98-417B-B833-23F6E057AA1F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_vx1800v:1.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "09F22693-CB76-46A3-A6C7-8D778713C3A0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}