{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3227", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-02-25T20:03:19.802Z", "datePublished": "2026-03-13T21:38:31.666Z", "dateUpdated": "2026-03-17T03:55:35.442Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-03-16T16:16:25.873Z"}, "title": "Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "TL-WR802N v4", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "V4_260304", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "TL-WR841N v14", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "V14_260303", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP Link Systems Inc.", "product": "TL-WR840N v6", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "V6_260304", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. \nSuccessful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. <br>Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.<br><br>"}]}], "references": [{"url": "https://www.tp-link.com/en/support/download/tl-wr802n/v4/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/download/tl-wr802n/v4/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-wr841n/v14/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/download/tl-wr841n/v14/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-wr840n/v6/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5018/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "do4choo (github.com/do4choo)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-3227"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T03:55:35.442Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3227", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T15:30:42.503417Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T15:31:32.795Z"}}], "cna": {"title": "Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "do4choo (github.com/do4choo)"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "TL-WR802N v4", "versions": [{"status": "affected", "version": "0", "lessThan": "V4_260304", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "TL-WR841N v14", "versions": [{"status": "affected", "version": "0", "lessThan": "V14_260303", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP Link Systems Inc.", "product": "TL-WR840N v6", "versions": [{"status": "affected", "version": "0", "lessThan": "V6_260304", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/en/support/download/tl-wr802n/v4/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/download/tl-wr802n/v4/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-wr841n/v14/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/download/tl-wr841n/v14/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-wr840n/v6/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5018/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. \nSuccessful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.", "supportingMedia": [{"type": "text/html", "value": "A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. <br>Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-03-16T16:16:25.873Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3227", "state": "PUBLISHED", "dateUpdated": "2026-03-17T03:55:35.442Z", "dateReserved": "2026-02-25T20:03:19.802Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-03-13T21:38:31.666Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wr802n_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1A754B83-7C61-4467-AC85-C53B7427BA6B", "versionEndExcluding": "260304", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wr802n:v4:*:*:*:*:*:*:*", "matchCriteriaId": "8FA6C0FF-B3F6-41CA-A0CD-FBF40EDC413B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC4686F9-6497-4CB6-9EC8-940AED07D6CC", "versionEndExcluding": "260303", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wr841n:14:*:*:*:*:*:*:*", "matchCriteriaId": "D74FA034-63F6-4F9E-BC24-364B94732E29", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wr840n_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "482864E3-0331-455C-9696-E39E836C1CF1", "versionEndExcluding": "260304", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wr840n:6:*:*:*:*:*:*:*", "matchCriteriaId": "CE7A6651-E143-443C-8189-72A3BD0D76F0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. \nSuccessful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos fue identificada en TP-Link TL-WR802N v4, TL-WR841N v14 y TL-WR840N v6 debido a la neutralizaci\u00f3n inadecuada de elementos especiales utilizados en un comando del sistema operativo. La funci\u00f3n de importaci\u00f3n de configuraci\u00f3n del router permite a un atacante autenticado cargar un archivo de configuraci\u00f3n manipulado que resulta en la ejecuci\u00f3n de comandos del sistema operativo con privilegios de root durante el procesamiento de activaci\u00f3n de puertos. La explotaci\u00f3n exitosa permite a un atacante autenticado ejecutar comandos del sistema con privilegios de root, lo que lleva a un compromiso total del dispositivo."}], "id": "CVE-2026-3227", "lastModified": "2026-04-07T01:07:52.933", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}, "published": "2026-03-16T14:19:47.257", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/tl-wr802n/v4/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/tl-wr840n/v6/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/tl-wr841n/v14/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/us/support/download/tl-wr802n/v4/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/us/support/download/tl-wr841n/v14/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Vendor Advisory"], "url": "https://www.tp-link.com/us/support/faq/5018/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,V4_260304)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "TL-WR802N v4", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "tl-wr802n", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,V14_260303)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "TL-WR841N v14", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "tl-wr841n", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,V6_260304)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "TL-WR840N v6", "source": "cna", "vendor": "TP Link Systems Inc."}, "product": "tl-wr840n", "vendor": "tp_link"}], "analysis": {"en": {"generated_at": "2026-04-07T10:24:14.732581+00:00", "value": {"mitigation_remediation": ["Identify the router model and verify the current firmware version.", "Download the latest firmware release from the official TP\u2011Link website using the vendor advisory links.", "Install the firmware update on each affected device following the manufacturer\u2019s instructions.", "Confirm that the configuration import feature no longer accepts unsanitized input and that command execution is no longer possible.", "Monitor router logs for evidence of attempted or successful command execution attempts.", "If a firmware update cannot be applied, disable the configuration import function or remove the device from the network until the vulnerability can be patched."], "summary": {"action": "Immediate Patch", "impact": "Remote Command Execution with root privileges"}, "threat_synthesis": {"affected_systems": "The affected products are TP\u2011Link TL\u2011WR840N firmware v6, TL\u2011WR802N firmware v4, and TL\u2011WR841N firmware v14. These models are specifically listed in the vendor\u2019s advisory and correspond to the relevant firmware product identifiers.", "description_and_impact": "A command injection flaw exists in TP\u2011Link TL\u2011WR802N v4, TL\u2011WR841N v14, and TL\u2011WR840N v6 routers due to improper neutralization of special elements used in an OS command. An authenticated attacker who can log into the router\u2019s administration interface can upload a crafted configuration file that is processed during port\u2011trigger processing, causing arbitrary OS commands to execute with root privileges. Successful exploitation permits full device compromise, allowing the attacker to control the router at the system level.", "risk_and_exploitability": "The CVSS score of 8.5 indicates a high severity level. The EPSS score of less than 1% suggests that the likelihood of exploitation in the near term is low, and the vulnerability is not yet cataloged in the CISA KEV list. However, because the flaw requires only an authenticated session, any user or attacker who has gained administrative access could exploit the vulnerability. Full root\u2011level execution on the router vastly increases the potential damage and therefore represents a high\u2011risk condition that should prompt prompt remediation."}}}}, "created": "2026-03-16T09:22:31.868594+00:00", "updated": "2026-04-08T20:02:36.081201+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$tl-wr802n", "tp-link$PRODUCT$tl-wr841n", "tp_link", "tp_link$PRODUCT$tl-wr840n"]}