VulnerabilityAnalyzed

CVE-2026-15428

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter.

HIGH 8.5EPSS 1.00%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.00%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges. Successful exploitation may allow remote code execution and complete compromise of the device.

CVSS 4.0: 8.5 HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 1.00% probability · 61th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: tp-link/archer vx1800v firmware
Source: f23511db-6c3e-4e32-a477-6aa17d310630

References

https://www.tp-link.com/en/support/download/archer-vx1800v/#FirmwareProduct
https://www.tp-link.com/us/support/faq/5189/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.