A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized command execution during device initialization or provisioning workflows. This typically occurs when the device is in a factory-default or unconfigured state. Successful exploitation may allow an adjacent, unauthenticated attacker to execute arbitrary commands with elevated privileges, potentially leading to full compromise of the affected device and unauthorized administrative control.

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Tp-link
  • Archer C20 V5
  • Archer C20 V6
  • Archer Mr200 V07
  • Archer Mr200 V8
  • Archer Vr2100 V1
  • Tl-mr6400 V7
Tp Link
  • Archer Mr402 V1

No data.

No data.

References
Link Providers
https://www.tp-link.com/en/support/download/archer-c20/ cve-icon
https://www.tp-link.com/en/support/download/archer-mr200/#Firmware cve-icon
https://www.tp-link.com/en/support/download/archer-mr402/#Firmware cve-icon
https://www.tp-link.com/en/support/download/archer-vr2100/#Firmware cve-icon
https://www.tp-link.com/en/support/download/tl-mr6400/v7/#Firmware cve-icon
https://www.tp-link.com/us/support/download/archer-c20/ cve-icon
https://www.tp-link.com/us/support/faq/5141/ cve-icon
History

Tue, 23 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Tp-link
Tp-link archer C20 V5
Tp-link archer C20 V6
Tp-link archer Mr200 V07
Tp-link archer Mr200 V8
Tp-link archer Vr2100 V1
Tp-link tl-mr6400 V7
Tp Link
Tp Link archer Mr402 V1
Vendors & Products Tp-link
Tp-link archer C20 V5
Tp-link archer C20 V6
Tp-link archer Mr200 V07
Tp-link archer Mr200 V8
Tp-link archer Vr2100 V1
Tp-link tl-mr6400 V7
Tp Link
Tp Link archer Mr402 V1

Mon, 22 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 22 Jun 2026 18:45:00 +0000

Type Values Removed Values Added
Description A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized command execution during device initialization or provisioning workflows. This typically occurs when the device is in a factory-default or unconfigured state. Successful exploitation may allow an adjacent, unauthenticated attacker to execute arbitrary commands with elevated privileges, potentially leading to full compromise of the affected device and unauthorized administrative control.
Title Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published: 2026-06-22T17:53:48.436Z

Updated: 2026-06-23T03:56:03.662Z

Reserved: 2026-06-09T22:14:54.973Z

Link: CVE-2026-11834

cve-icon Vulnrichment

Updated: 2026-06-22T19:54:37.917Z

cve-icon NVD

No data.

cve-icon Redhat

No data.