CVE-2026-15428

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges. Successful exploitation may allow remote code execution and complete compromise of the device.

Score

CVSS 3.1 8.8 High

Status

Analyzed - f23511db-6c3e-4e32-a477-6aa17d310630

Published

2026-07-14

Last modified

2026-10-24

Weaknesses

CWE-78

Affected products

• Archer Vx1800v Firmware (Tp-link)
• Archer Vx1800v V1 (Tp-link Systems Inc.)

References

• https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware
• https://www.tp-link.com/us/support/faq/5189/