CVE-2026-38709
Critical
Description
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the net.set_wan interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.
SeverityCritical
CVSS9.8
Exploit probability—
ProductTR1200
PublishedJul 30, 2026
First seenJul 30, 2026
Weakness typeCWE-77Command injection
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TR1200 | 2.4.15 | — |
| TR3000 | 2.4.21 | — |
| WR300 | 2.4.25 | — |
| WR1200 | 2.4.23 | — |
| WR1300 | 2.4.22 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.