CVE-2026-8913
High
Description
A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.
SeverityHigh
CVSS8.5
Exploit probability—
ProductArcher MR600 v5
PublishedJun 8, 2026
First seenJun 8, 2026
Weakness typeCWE-78OS command injection
How to fix
Update
- TP-Link Systems Inc. Archer MR600 v5EU_V5_1.7.0 0.9.1 260518 rel67803, JP_V5_1.2.0 0.9.1 260519 rel52362 or later
- TP-Link Systems Inc. Archer MR600 v21.12.0 Build 260826 or later
- TP-Link Systems Inc. Archer MR600 v31.4.0 Build 260827 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TP-Link Systems Inc. Archer MR600 v5 | v < EU_V5_1.7.0 0.9.1 260518 rel67803, v < JP_V5_1.2.0 0.9.1 260519 rel52362 | EU_V5_1.7.0 0.9.1 260518 rel67803, JP_V5_1.2.0 0.9.1 260519 rel52362 |
| TP-Link Systems Inc. Archer MR600 v2 | v < 1.12.0 Build 260826 | 1.12.0 Build 260826 |
| TP-Link Systems Inc. Archer MR600 v3 | v < 1.4.0 Build 260827 | 1.4.0 Build 260827 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.