CVE-2026-15427CWE-78command-injection

CVE-2026-15427

High · published July 14, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

An OS command

injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of

parameters, allowing crafted input to be executed as system-level commands.

Exploitation requires specific conditions such as TR-069 being enabled and ability

to influence ACS-delivered commands, compromise or control an ACS server.

Successful

exploitation may allow arbitrary command execution with root privileges,

resulting in complete compromise of the device.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00836 · 57.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-14T21:16Z
Affected products (2)
ProductVersionsFixed in
tp-link/archer_vx1800v_firmware< 0.16.00.16.0
tp-link/archer_vx1800v_firmwareall versions—
References (2)
https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/faq/5189/ · f23511db-6c3e-4e32-a477-6aa17d310630
EPSS history
Timeline
  • 14 JUL 17:02Z
    OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v
    cvelistv5