CVE-2026-3227CWE-78

Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N

High · published March 13, 2026

CVSS v4.0
8.5
EPSS
2%
Percentile
79.3
In the wild
Unconfirmed
What it is

A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing.

Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01876 · 79.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-13T21:38Z
EPSS history
Timeline
  • 13 MAR 21:38Z
    Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N
    cvelistv5