CVE-2026-9254 Overview
CVE-2026-9254 is an unauthenticated operating system (OS) command injection vulnerability affecting the parental control functionality of TP-Link Archer BE800 V1, Archer BE3600 V1, and Archer AX75 V1 routers. The vulnerability stems from improper filtering and neutralization of special characters in certain request parameters [CWE-78]. An attacker on the local area network (LAN) can inject arbitrary commands that execute with root privileges. Successful exploitation results in complete device compromise and impacts the confidentiality, integrity, and availability of the router and all traffic passing through it.
Critical Impact
A LAN-adjacent attacker can achieve unauthenticated root-level command execution on the affected Archer routers, enabling full device takeover and manipulation of network traffic.
Affected Products
- TP-Link Archer BE800 V1
- TP-Link Archer BE3600 V1
- TP-Link Archer AX75 V1
Discovery Timeline
- 2026-08-24 - CVE-2026-9254 published to the National Vulnerability Database (NVD)
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-9254
Vulnerability Analysis
The vulnerability resides in the parental control feature exposed by the router's management service. Specific request parameters accept user-supplied input that is passed to an underlying shell context without sufficient sanitization. Because the parental control endpoint does not require authentication, any device connected to the LAN or Wi-Fi network can reach the vulnerable code path. Commands injected through crafted parameters execute as the root user, granting full control over the router's operating system.
The attack requires network adjacency, meaning the attacker must be reachable on the same broadcast domain or trusted internal segment. This includes guest Wi-Fi clients, compromised endpoints inside the LAN, or malicious devices connected via wired ports.
Root Cause
The underlying weakness is classified as Improper Neutralization of Special Elements used in an OS Command [CWE-78]. Input from HTTP request parameters flows into a command execution routine without allowlisting, escaping, or parameterized invocation. Shell metacharacters such as backticks, semicolons, pipes, and command substitution sequences are passed through to the shell interpreter.
Attack Vector
The attack vector is adjacent network access. An attacker with LAN reachability sends a crafted HTTP request to the parental control endpoint containing shell metacharacters embedded in vulnerable parameters. The router's web management service concatenates the input into a system command and executes it as root. Detailed proof-of-concept code has not been published in the referenced advisories. Refer to the TP-Link FAQ Document for vendor-provided technical context.
Detection Methods for CVE-2026-9254
Indicators of Compromise
- Unexpected outbound connections originating from the router's management IP to attacker-controlled hosts.
- New or modified files in router persistent storage, particularly startup scripts or firewall configuration.
- Anomalous DNS resolver settings pointing to unauthorized servers, which can indicate traffic redirection.
- Unusual HTTP POST requests to parental control endpoints containing shell metacharacters such as ;, |, `, or $(.
Detection Strategies
- Inspect wired and wireless network telemetry for HTTP requests targeting the router management interface with suspicious parameter payloads.
- Correlate DHCP lease logs with HTTP traffic to identify LAN clients probing router administrative paths.
- Monitor for firmware version strings that indicate unpatched Archer BE800 V1, BE3600 V1, or AX75 V1 devices on the network.
Monitoring Recommendations
- Enable syslog forwarding from the router to a centralized logging platform and alert on parental control configuration changes.
- Baseline router-originated egress traffic and alert on new destinations, non-standard ports, or persistent outbound sessions.
- Track administrative interface access from unexpected internal hosts and unmanaged devices.
How to Mitigate CVE-2026-9254
Immediate Actions Required
- Apply the latest firmware update for Archer BE800 V1, BE3600 V1, and AX75 V1 from the TP-Link firmware download pages linked below.
- Restrict access to the router's LAN management interface to a dedicated administrative VLAN or trusted host set.
- Disable the parental control feature until patched firmware has been installed and verified.
- Segment guest Wi-Fi from internal networks to reduce the pool of attackers with LAN adjacency.
Patch Information
TP-Link publishes firmware updates for each affected model on its regional support portals. Consult the following resources and install the newest available firmware version for your device: Archer BE800 Firmware, Archer BE3600 Firmware, and Archer AX75 Firmware. U.S. customers should use the Archer BE800 US Firmware, Archer BE3600 US Firmware, and Archer AX75 US Firmware pages. Additional guidance is available in the TP-Link FAQ Document.
Workarounds
- Disable the parental control feature in the router web interface until firmware can be applied.
- Change default administrative credentials and enforce strong, unique passwords for router management.
- Isolate untrusted LAN clients, including IoT and guest devices, on separate SSIDs and VLANs to limit adjacent-network exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
