CVE-2026-102294
High
Description
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration or services, and disruption of device operation.
SeverityHigh
CVSS8.5
Exploit probability—
ProductTL-WR841N v14
PublishedOct 1, 2026
First seenOct 1, 2026
Weakness typeCWE-78OS command injection
How to fix
Update
- TP-Link System Inc. TL-WR841N v144.19 Build 260821 (EN), 4.19 Build 260820 (US) or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TP-Link System Inc. TL-WR841N v14 | v < 4.19 Build 260821 (EN), v < 4.19 Build 260820 (US) | 4.19 Build 260821 (EN), 4.19 Build 260820 (US) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.