Read the docs
TI-2026-86094 Aliases CVE-2026-109683GHSA-g78m-w5rq-g992

Newline injection in TP-Link Archer BE805 UPnP service

Priority LOW 24CWE-93Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

TP-Link Archer BE805 v1 is affected before V1.6_1.5.1 Build 261102 and before V1.20_1.5.1 Build 261102. Newline characters in UPnP port-mapping descriptions are not sanitized (CWE-93). An unauthenticated attacker on the local network can inject newlines to modify runtime UPnP mappings and create spoofed entries. The impact is limited to mapping data integrity, with no code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A newline injection vulnerability exists in the UPnP service of Archer BE805 v1 such that an adjacent attacker can supply newline characters in a UPnP port-mapping description due to improper sanitization, resulting in possible injection of unintended content into UPnP port-mapping data. Successful exploitation may allow an unauthenticated attacker on the local network to modify runtime UPnP port-mapping information and create spoofed entries within the affected service. The issue is limited to the integrity of UPnP mapping data and does not demonstrate code execution or privilege escalation.

Why it matters now

EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed Archer BE805 v1 (TP-Link Systems Inc.): V1.6_1.5.1 Build 261102, V1.20_1.5.1 Build 261102

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkArcher BE805 v1before V1.6_1.5.1 Build 261102; before V1.20_1.5.1 Build 261102V1.6_1.5.1 Build 261102, V1.20_1.5.1 Build 261102Patch availableCNA
  • Archer BE805 v1 VendorTP-Link Affected before V1.6_1.5.1 Build 261102; before V1.20_1.5.1 Build 261102 Fixed in V1.6_1.5.1 Build 261102, V1.20_1.5.1 Build 261102 Patch available CNA

Remediation

Upgrade to V1.6_1.5.1 Build 261102 or V1.20_1.5.1 Build 261102, the fixed builds for Archer BE805 v1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Archer BE805 v1 (TP-Link Systems Inc.) Fixed in V1.6_1.5.1 Build 261102, V1.20_1.5.1 Build 261102

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-109683
  2. 2026-11-06 Alias added: GHSA-g78m-w5rq-g992

References

Patch 2

Advisory 1

  • TI-2023-16571 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain… KEVCVSS 3.1HIGH 8.8
  • TI-2023-01313 Command injection in TP-Link Archer AX21 KEVCVSS 3.1HIGH 8.8
  • TI-2020-14907 TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the… KEVCVSS 3.1HIGH 8.8
  • TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
  • TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
  • TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
See all 636 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences