TP-Link TL-WR802N v4/TL-WR841N v14/TL-WR840N v6 Configuration File os command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in TP-Link TL-WR802N v4, TL-WR841N v14 and TL-WR840N v6. This affects an unknown function of the component Configuration File Handler. Performing a manipulation results in os command injection. This vulnerability is identified as CVE-2026-3227. The attack can only be performed from the local network. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in TP-Link TL-WR802N v4, TL-WR841N v14 and TL-WR840N v6 (affected version unknown). It has been classified as critical. This affects an unknown functionality of the component Configuration File Handler. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.

It is possible to read the advisory at tp-link.com. This vulnerability is uniquely identified as CVE-2026-3227 since 02/25/2026. The exploitability is told to be easy. The attack can only be done within the local network. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-12171). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• TP-Link

Name

• TL-WR802N v4
• TL-WR840N v6
• TL-WR841N v14

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion