Security Advisory on Authenticated Command Injection Vulnerability on TP-Link TL-WR802N, TL-WR841N and TL-WR840N (CVE-2026-3227)
2298 Vulnerability and Impact Description:
CVE-2026-3227:
A command injection vulnerability was identified due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing.
Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.
CVSS v4.0 Score: 8.5 / High
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products/Versions and Fixes:
|
Affected Product/ Model |
Affected Version |
|
TL‑WR802N v4 |
< V4_260304 |
|
TL‑WR841N v14 |
< V14_260303 |
|
TL‑WR840N v6 |
< V6_260304 |
Recommendations:
We strongly recommend that users with affected devices take the following actions:
- Download and update to the latest firmware version to fix the vulnerabilities.
EN: Download for TL-WR802N | TP-Link
Download for TL-WR841N | TP-Lin
Download for TL-WR840N | TP-Link
US: Download for TL-WR802N | TP-Link
Download for TL-WR841N | TP-Link
Note: TL-WR840N is not sold in the US.
Disclaimer:
If you do not take all recommended actions, this vulnerability will remain. TP-Link cannot bear any responsibility for consequences that could have been avoided by following this advisory.
Is this faq useful?
Your feedback helps improve this site.
TP-Link Community
Still need help? Search for answers, ask questions, and get help from TP-Link experts and other users around the world.