CVE-2026-11834

published 2026-06-22

CVE-2026-11834: A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of…

Priority P3 55 high 8.7 CVSS 4.0

AV A AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A command
injection vulnerability has been identified in the DHCP option processing logic
in multiple TP-Link router models, due to insufficient validation of externally
supplied DHCP option data. An adjacent attacker may exploit this
vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized
command execution during device initialization or provisioning workflows. This
typically occurs when the device is in a factory-default or unconfigured state.

Successful
exploitation may allow an adjacent, unauthenticated attacker to execute
arbitrary commands with elevated privileges, potentially leading to full
compromise of the affected device and unauthorized administrative control.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
tp-link_systems_inc	archer_c20_v5	< EU_V5_260317	EU_V5_260317
tp-link_systems_inc	archer_c20_v5	< US_V5_260419	US_V5_260419
tp-link_systems_inc	archer_c20_v6	< V6_260608	V6_260608
tp-link_systems_inc	archer_mr200_v07	< 1.3.0 Build 250605	1.3.0 Build 250605
tp-link_systems_inc	archer_mr200_v8	< 1.5.0 Build 260605	1.5.0 Build 260605
tp-link_systems_inc	archer_vr2100_v1	< EU_V1_260330	EU_V1_260330
tp-link_systems_inc	tl-mr6400_v7	< 1.7.0 Build 260413	1.7.0 Build 260413
tp_link_systems_inc	archer_mr402_v1	< 1.5.0 Build 260605	1.5.0 Build 260605

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78