CVE-2026-11834: TP-Link Router DHCP RCE Vulnerability

CVE-2026-11834 Overview

CVE-2026-11834 is a command injection vulnerability [CWE-78] in the Dynamic Host Configuration Protocol (DHCP) option processing logic of multiple TP-Link router models. The flaw stems from insufficient validation of externally supplied DHCP option data. An adjacent attacker on the same network segment can supply crafted DHCP responses to trigger unauthorized command execution during device initialization or provisioning workflows. Exploitation typically requires the device to be in a factory-default or unconfigured state. Successful exploitation allows an unauthenticated, adjacent attacker to execute arbitrary commands with elevated privileges, potentially yielding full compromise of the affected router.

Critical Impact
Adjacent, unauthenticated attackers can achieve arbitrary command execution with elevated privileges on factory-default TP-Link routers, enabling full device compromise and unauthorized administrative control.

Affected Products

TP-Link Archer C20, Archer MR200, and Archer MR402 routers
TP-Link Archer VR2100 router
TP-Link TL-MR6400 v7 router

Discovery Timeline

2026-06-22 - CVE-2026-11834 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-11834

Vulnerability Analysis

The vulnerability resides in the DHCP client logic embedded in multiple TP-Link router firmware images. When the router boots in a factory-default or unconfigured state, it issues DHCP discovery requests to obtain provisioning information. Incoming DHCP responses include option fields, such as hostname, domain, or vendor-specific parameters, that the router parses and incorporates into internal configuration routines.

The firmware fails to sanitize option values before passing them to shell or system command interpreters. Attacker-controlled option data is concatenated into commands executed during initialization. This is a classic OS command injection flaw [CWE-78], where untrusted input crosses a trust boundary into a command processor with elevated privileges.

Because the affected workflow runs early in the device lifecycle, exploitation does not require credentials or user interaction. The DHCP transaction itself delivers the payload.

Root Cause

The root cause is missing input validation on DHCP option fields received from the network. The firmware treats option strings as trusted configuration data rather than untrusted external input. Shell metacharacters and command separators embedded in option values are passed directly to command execution functions, allowing attacker-supplied commands to run with router-level privileges.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be on the same Layer 2 broadcast domain as the target router. A rogue DHCP server, or a host responding faster than the legitimate DHCP server, sends a crafted DHCP OFFER or ACK containing malicious option data. When the target router parses the response during provisioning, the injected commands execute. The technical details for each model are available in the TP-Link firmware download portals referenced below.

Detection Methods for CVE-2026-11834

Indicators of Compromise

Unexpected DHCP OFFER or ACK packets containing shell metacharacters such as backticks, semicolons, or $() inside option fields like hostname (option 12), domain (option 15), or vendor-specific options (option 43, 60, 125).
Presence of rogue or unauthorized DHCP servers on segments hosting TP-Link consumer or small business routers.
Outbound connections from router management interfaces to unknown hosts shortly after device power-on or factory reset.
Unexpected configuration changes, new administrative accounts, or modified DNS settings on affected TP-Link routers.

Detection Strategies

Inspect DHCP traffic at network ingress points and flag option strings containing shell metacharacters or oversized values.
Deploy DHCP snooping on managed switches to restrict DHCP server responses to authorized ports only.
Compare router firmware versions and configurations against vendor-published baselines on a recurring schedule.

Monitoring Recommendations

Log DHCP transactions and alert on responses originating from unauthorized MAC or IP addresses.
Monitor router syslog output for command execution errors or unexpected process activity during boot.
Track outbound connections from router IP addresses to non-standard destinations, particularly during provisioning windows.

How to Mitigate CVE-2026-11834

Immediate Actions Required

Apply the latest firmware updates published by TP-Link for each affected model before returning devices to service.
Avoid provisioning or factory-resetting affected routers on untrusted networks where rogue DHCP responses may be present.
Enable DHCP snooping and port security on switches that connect to TP-Link routers to block unauthorized DHCP servers.
Segment management and provisioning networks from general-purpose user VLANs.

Patch Information

TP-Link has published firmware downloads for the affected models on its regional support portals. Refer to the official pages for the TP-Link Archer C20 Firmware, TP-Link Archer MR200 Firmware, TP-Link Archer MR402 Firmware, TP-Link Archer VR2100 Firmware, and TP-Link TL-MR6400 v7 Firmware. Additional guidance is provided in TP-Link FAQ #5141.

Workarounds

Provision affected routers only on isolated networks where the DHCP server is known to be trusted.
Disable automatic DHCP-based provisioning workflows where feasible and use static configuration instead.
Restrict physical and wireless access to affected routers until firmware updates are applied.

bash

# Example: enable DHCP snooping on a Cisco switch to block rogue DHCP responses
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet0/1
 ip dhcp snooping trust
interface range GigabitEthernet0/2 - 24
 no ip dhcp snooping trust
 ip dhcp snooping limit rate 10
end