← Back to CVE Explorer

CVE-2026-15427

Full vulnerability record from the local CVENow database.

Description

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069 being enabled and ability to influence ACS-delivered commands, compromise or control an ACS server. Successful exploitation may allow arbitrary command execution with root privileges, resulting in complete compromise of the device.

Severity
HIGH
CVSS score
8.6 (v4.0)
Vulnerability status
Analyzed
Source identifier
f23511db-6c3e-4e32-a477-6aa17d310630
Published
2026-07-14 17:16:44.653000
Last modified
2026-10-24 21:10:00.130000
View original CVE JSON 
{
  "id": "CVE-2026-15427",
  "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
  "published": "2026-07-14T17:16:44.653",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An OS command\ninjection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of\nparameters, allowing crafted input to be executed as system-level commands.\nExploitation requires specific conditions such as TR-069 being enabled and ability\nto influence ACS-delivered commands, compromise or control an ACS server.\n\n\n\n\n\nSuccessful\nexploitation may allow arbitrary command execution with root privileges,\nresulting in complete compromise of the device."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de comandos del sistema operativo existe en la interfaz de gestión TR-069 / CWMP del Archer VX1800v v1 debido a la validación de entrada y sanitización de parámetros insuficientes, lo que permite que la entrada manipulada se ejecute como comandos a nivel de sistema.\nLa explotación requiere condiciones específicas, como que TR-069 esté habilitado y la capacidad de influir en los comandos entregados por el ACS, comprometer o controlar un servidor ACS.\n\nLa explotación exitosa puede permitir la ejecución arbitraria de comandos con privilegios de root, lo que resulta en el compromiso completo del dispositivo."
    }
  ],
  "affected": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "affectedData": [
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "Archer VX1800v v1",
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-14T00:00:00+00:00",
          "id": "CVE-2026-15427",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:tp-link:archer_vx1800v_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.16.0",
              "matchCriteriaId": "03B92A44-2879-474C-AD7E-4917B95EDC3A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:tp-link:archer_vx1800v_firmware:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC7661D9-BA98-417B-B833-23F6E057AA1F"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:tp-link:archer_vx1800v:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "09F22693-CB76-46A3-A6C7-8D778713C3A0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.tp-link.com/en/support/download/archer-vx1800v/#Firmware",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.tp-link.com/us/support/faq/5189/",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}