CVE-2026-15429CWE-93

CVE-2026-15429

High · published July 14, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
72.1
In the wild
Unconfirmed
What it is

A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data.

An

authenticated user with sufficient privileges may be able to modify account

settings and gain elevated administrative privileges.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01389 · 72.1th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-07-14T21:16Z
Affected products (2)
ProductVersionsFixed in
tp-link/archer_vx1800v_firmware< 0.16.00.16.0
tp-link/archer_vx1800v_firmwareall versions—
References (2)
https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/faq/5189/ · f23511db-6c3e-4e32-a477-6aa17d310630
EPSS history
Timeline
  • 14 JUL 17:04Z
    Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v
    cvelistv5