---
id: CVE-2026-109683
title: UPnP Newline Injection Vulnerability in TP-Link Archer BE805
summary: >-
  A newline

  injection vulnerability exists in the UPnP service of Archer BE805 v1 such
  that

  an adjacent attacker can supply newline characters in a UPnP port-mapping

  description due to improper sanitization, resulting in possible injection…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-93
vendor: TP-Link Systems Inc.
product: Archer BE805 v1
affected:
  - archer_be805_v1 < V1.6_1.5.1 Build 261102
  - archer_be805_v1 < V1.20_1.5.1 Build 261102
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T19:26:40.010Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109683'
references:
  - url: 'https://www.tp-link.com/us/support/download/archer-be805/#Firmware'
  - url: 'https://www.tp-link.com/en/support/download/archer-be805/v1.20/#Firmware'
  - url: 'https://www.tp-link.com/us/support/faq/5389/'
tags:
  - cve.org
ingestedAt: '2026-11-06T20:03:04.276Z'
epss: 0.00313
epssPercentile: 0.2433
---

## Overview

A newline
injection vulnerability exists in the UPnP service of Archer BE805 v1 such that
an adjacent attacker can supply newline characters in a UPnP port-mapping
description due to improper sanitization, resulting in possible injection of unintended
content into UPnP port-mapping data.









Successful
exploitation may allow an unauthenticated attacker on the local network to
modify runtime UPnP port-mapping information and create spoofed entries within
the affected service. The issue is limited to the integrity of UPnP mapping
data and does not demonstrate code execution or privilege escalation.

## Affected

- `archer_be805_v1 < V1.6_1.5.1 Build 261102`
- `archer_be805_v1 < V1.20_1.5.1 Build 261102`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.