← Back to CVE Explorer

CVE-2026-11409

Full vulnerability record from the local CVENow database.

Description

An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.

Severity
HIGH
CVSS score
8.5 (v4.0)
Vulnerability status
Analyzed
Source identifier
f23511db-6c3e-4e32-a477-6aa17d310630
Published
2026-06-17 13:19:33.187000
Last modified
2026-10-26 12:10:00.130000
View original CVE JSON 
{
  "id": "CVE-2026-11409",
  "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
  "published": "2026-06-17T13:19:33.187",
  "lastModified": "2026-10-26T12:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de comandos del sistema operativo autenticada existe en el gestor de configuración IPv6 PPPoE en TL-WR940N v6 debido a la sanitización inadecuada de la entrada del usuario. Un atacante con acceso administrativo puede explotar este problema para ejecutar comandos de sistema arbitrarios con privilegios elevados."
    }
  ],
  "affected": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "affectedData": [
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "TL-WR940N v6",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "V6_260528",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-17T00:00:00+00:00",
          "id": "CVE-2026-11409",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:tp-link:tl-wr940n_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "260528",
              "matchCriteriaId": "2E4DC152-9198-4DAE-8170-8EC3CEB21CE9"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:tp-link:tl-wr940n:v6:*:*:*:*:*:*:*",
              "matchCriteriaId": "714E7A62-634A-4DF8-B5AF-D6B306808B54"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.tp-link.com/en/support/download/tl-wr940n/v6/#Firmware",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.tp-link.com/us/support/faq/5131/",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}