{"id":"CVE-2026-8913","title":"A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface","summary":"A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with adm…","severity":"high","cwe":["CWE-78"],"published":"2026-06-08","updated":"2026-11-03","sourceUpdated":"2026-11-03T20:18:19.353","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8913","references":[{"url":"https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/en/support/download/archer-mr600/v3/#Firmware","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/jp/support/download/archer-mr600/v5/#Firmware","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5122/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"tags":["nvd","cve.org"],"epss":0.01073,"epssPercentile":0.65111,"ingestedAt":"2026-11-05T06:38:03.617Z","vendor":"TP-Link Systems Inc.","product":"Archer MR600 v5","affected":["archer_mr600_v5 < EU_V5_1.7.0 0.9.1 260518 rel67803","archer_mr600_v5 < JP_V5_1.2.0 0.9.1 260519 rel52362","archer_mr600_v2 < 1.12.0 Build 260826","archer_mr600_v3 < 1.4.0 Build 260827"],"cvss":8.5,"cvssVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-06-08T00:00:00+00:00"},"cvssSource":"cna","slug":"CVE-2026-8913","body":"## Overview\n\nA command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":46.8,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":234531,"id":"CVE-2026-8913","ts":1793914655055,"field":"cvss","old":null,"new":"8.5"},{"seq":234530,"id":"CVE-2026-8913","ts":1793914655055,"field":"severity","old":"none","new":"high"}]}