---
id: CVE-2026-8913
title: >-
  A command Injection vulnerability exists in the WireGuard client configuration
  of Archer MR600 v2, v3, and v5 due to improper neutralization of
  user-controlled input within the web management interface
summary: >-
  A command Injection vulnerability exists in the WireGuard client configuration
  of Archer MR600 v2, v3, and v5 due to improper neutralization of
  user-controlled input within the web management interface. An authenticated
  attacker with adm…
severity: high
cwe:
  - CWE-78
published: '2026-06-08'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:18:19.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8913'
references:
  - url: 'https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/en/support/download/archer-mr600/v3/#Firmware'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/jp/support/download/archer-mr600/v5/#Firmware'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/faq/5122/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
  - cve.org
epss: 0.01073
epssPercentile: 0.65111
ingestedAt: '2026-11-05T06:38:03.617Z'
vendor: TP-Link Systems Inc.
product: Archer MR600 v5
affected:
  - archer_mr600_v5 < EU_V5_1.7.0 0.9.1 260518 rel67803
  - archer_mr600_v5 < JP_V5_1.2.0 0.9.1 260519 rel52362
  - archer_mr600_v2 < 1.12.0 Build 260826
  - archer_mr600_v3 < 1.4.0 Build 260827
cvss: 8.5
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-08T00:00:00+00:00'
cvssSource: cna
---

## Overview

A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.