Read the docs
TI-2026-52913 Aliases CVE-2026-75616GHSA-5w3w-j62r-pw52

Command Injection in Router Web Management Interface

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise. Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02827 86th percentileScored 2026-11-07
Fix Fixed Archer C20 v6 (TP-Link Systems Inc.): EU_0.9.1 Build 260811, US_0.9.1 Build 260812, RU_0.9.1 Build 260812

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkArcher C20 v6before EU_0.9.1 Build 260811; before US_0.9.1 Build 260812; before RU_0.9.1 Build 260812EU_0.9.1 Build 260811, US_0.9.1 Build 260812, RU_0.9.1 Build 260812Patch availableCNA
  • Archer C20 v6 VendorTP-Link Affected before EU_0.9.1 Build 260811; before US_0.9.1 Build 260812; before RU_0.9.1 Build 260812 Fixed in EU_0.9.1 Build 260811, US_0.9.1 Build 260812, RU_0.9.1 Build 260812 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:archer_c20_firmware:*:*:*:*:*:*:*:*before 0.9.1VulnerableTP-Link
cpe:2.3:h:tp-link:archer_c20:6.0:*:*:*:*:*:*:*6.0Running onTP-Link
  • cpe:2.3:o:tp-link:archer_c20_firmware:*:*:*:*:*:*:*:* Versions before 0.9.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_c20:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·TP-Link

Remediation

  • Fix · CNA Archer C20 v6 (TP-Link Systems Inc.) Fixed in EU_0.9.1 Build 260811, US_0.9.1 Build 260812, RU_0.9.1 Build 260812

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75616
  2. 2026-10-03 Alias added: GHSA-5w3w-j62r-pw52

References

Patch 2

Advisory 1

  • TI-2026-00615 Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13 CVSS 4.0HIGH 7.2
  • TI-2023-14256 TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707… CVSS 3.1HIGH 7.5
  • TI-2023-18914 Improper authentication in TP-Link Archer C20 CVSS 3.1HIGH 8.8
  • TI-2025-14190 LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences