CVE-2026-102294CWE-78command-injection

CVE-2026-102294

published October 1, 2026

CVSS
8.5
EPSS
1%
Percentile
60.1
In the wild
Unconfirmed
What it is

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands.

Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration or services, and disruption of device operation.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
8.5 · CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00924 · 60.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-01T22:17Z
References (3)
https://www.tp-link.com/en/support/download/tl-wr841n/v14/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/download/tl-wr841n/v14/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/faq/5320/ · f23511db-6c3e-4e32-a477-6aa17d310630
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 01 OCT 17:30Z
    Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration
    cvelistv5