Security Advisory: Multiple OS Command Injection Vulnerabilities in TP-Link TL-WR940N (CVE-2026-11409 to CVE-2026-11410)

Description of Vulnerabilities and Impacts:

Multiple authenticated OS command injection vulnerabilities have been identified in TL-WR940N v6. These vulnerabilities affect specific WAN configuration modules due to insufficient input validation of user-supplied parameters.

Successful exploitation requires authenticated access to the web management interface and may allow execution of arbitrary system commands with elevated privileges, access sensitive information, modify system configuration, and disrupt device availability. These impacts may affect the confidentiality, integrity, and availability of the device.

CVE-2026-11409: OS Command Injection in IPv6 PPPoE Configuration

An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler due to improper sanitization of user-supplied input. This input may be incorporated into system command execution.

CVE-2026-11410: OS Command Injection in BigPond Cable (BPA) Configuration

An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module, where certain parameters are not properly sanitized before being used in system command construction.

The above CVEs share the same severity rating

CVSS v4.0 Score: 8.5/ High

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Important Information:

This device has reached end-of-life (EOL); therefore, please review the ‘Recommendation(s)’ section carefully.

Recommendations:

We strongly recommend that users with affected devices take the following actions:

1. Follow the instructions to update to the latest firmware version to fix the vulnerabilities:

US: Download for TL-WR940N | TP-Link

EN: Download for TL-WR940N | TP-Link

2. Upgrade the device to one of our supported models to be able to receive automatic updates for ongoing protection.
3. Limit administrative access: restrict access to the web management interface to trusted networks only.

Disclaimer:

This advisory is provided for informational purposes only and is subject to change without notice. The information is provided “as is” without warranties of any kind. TP-Link recommends that customers promptly apply available firmware updates or implement documented workarounds as provided in this advisory. Devices/systems that are not updated or mitigated as described may remain vulnerable, and TP-Link disclaims any responsibility or liability for any damages or losses arising from a failure to implement such updates.