CVE-2026-8913: Archer MR600 v5 RCE Vulnerability

CVE-2026-8913 Overview

CVE-2026-8913 is a command injection vulnerability in the WireGuard client configuration of the TP-Link Archer MR600 v5 router. The flaw exists in the web management interface, where user-controlled input is not properly neutralized before being passed to system command execution. An authenticated attacker holding administrative privileges on the device can inject arbitrary operating system commands when applying WireGuard configuration changes. Successful exploitation results in full compromise of the device's confidentiality, integrity, and availability. The vulnerability is tracked under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Authenticated adjacent-network attackers can execute arbitrary OS commands on the router, leading to full device takeover and pivot opportunities into the connected network.

Affected Products

TP-Link Archer MR600 v5 (WireGuard client configuration component of the web management interface)
Firmware versions prior to the vendor-supplied fix (see TP-Link Archer MR600 Firmware Download)
Deployments exposing the router web management interface to adjacent network segments

Discovery Timeline

2026-06-08 - CVE-2026-8913 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-8913

Vulnerability Analysis

The vulnerability lives in the WireGuard client configuration handler exposed through the Archer MR600 v5 web management interface. When an administrator applies a WireGuard configuration, the firmware constructs an underlying shell command using user-supplied fields without proper sanitization or argument quoting. Attackers can embed shell metacharacters (such as ;, |, &&, or backticks) into a configuration field to break out of the intended command context.

Because router daemons typically execute as root, injected commands run with the highest privilege on the embedded Linux platform. This grants attackers the ability to modify firmware, exfiltrate credentials, disable security controls, alter DNS settings, or install persistent backdoors. The attack vector is adjacent network, meaning the attacker must reach the management interface over LAN, Wi-Fi, or VPN.

Root Cause

The root cause is improper neutralization of special elements passed to an OS command, classified as [CWE-78]. The web interface accepts WireGuard client parameters and concatenates them into a shell invocation rather than executing the underlying binary with a safe argument array. Any field that influences the command string becomes an injection sink.

Attack Vector

An attacker first obtains administrative credentials, whether through default credentials, credential reuse, phishing, or session hijacking on the local network. The attacker then navigates to the WireGuard client configuration page and submits a malicious value containing shell metacharacters in a configurable field. When the router applies the configuration, the injected payload executes as part of the underlying system command, giving the attacker arbitrary code execution on the device.

No verified proof-of-concept code is publicly available for CVE-2026-8913. Refer to the TP-Link Archer MR600 FAQ and vendor advisories for technical specifics.

Detection Methods for CVE-2026-8913

Indicators of Compromise

Unexpected administrative logins to the Archer MR600 v5 web interface from adjacent network hosts
WireGuard configuration entries containing shell metacharacters such as ;, |, `, $(, or &&
Outbound connections from the router to unknown infrastructure shortly after configuration changes
New or modified processes, cron jobs, or startup scripts on the router

Detection Strategies

Audit router web management logs for configuration changes to the WireGuard client section, correlating against authorized change windows
Inspect saved WireGuard configuration values for non-printable or shell-special characters that should never appear in legitimate field input
Monitor for anomalous DNS, NTP, or HTTP traffic originating from the router's management interface address

Monitoring Recommendations

Forward router syslog and authentication events to a centralized log platform for retention and correlation
Alert on administrative authentication events sourced from non-administrative VLANs or guest networks
Track firmware version and configuration hashes across managed routers to identify drift indicative of compromise

How to Mitigate CVE-2026-8913

Immediate Actions Required

Apply the latest firmware update for the Archer MR600 v5 from the TP-Link Archer MR600 Firmware Download page as soon as it is available
Rotate all administrative credentials on affected routers and disable any default or shared accounts
Restrict access to the web management interface to a dedicated management VLAN or trusted host
Review existing WireGuard configurations for unauthorized or suspicious entries and reset them if any are found

Patch Information

TP-Link provides firmware updates for the Archer MR600 v5 through its regional support portals. Administrators should consult the TP-Link Archer MR600 Firmware Download (US) and TP-Link Archer MR600 Firmware Download (JP) pages for the firmware version that remediates CVE-2026-8913, and verify the release notes before deployment.

Workarounds

Disable the WireGuard client feature on the router until patched firmware is installed
Limit web management access to wired LAN only and disable remote management entirely
Enforce strong, unique administrator passwords and enable account lockout where supported
Segment the router management network from user, guest, and IoT segments to reduce adjacent-network exposure

bash

# Configuration example: restrict web management to a single trusted host
# (applied via the router's Security / Remote Management settings)
Remote Management: Disabled
Local Management Access: Specified IP only
Allowed Management IP: 192.0.2.10
Management Protocol: HTTPS only
Admin Password Policy: minimum 16 characters, rotated quarterly