CVE-2026-75616
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Command Injection in Router Web Management Interface
An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise. Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Archer C20 v6
- Vendor
- TP-Link Systems Inc.
- Product
- Archer C20 v6
- Platforms
- Linux
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | EU_0.9.1 Build 260811 | Unavailable | None listed |
| 0 | affected | custom | US_0.9.1 Build 260812 | Unavailable | None listed |
| 0 | affected | custom | RU_0.9.1 Build 260812 | Unavailable | None listed |