TP-Link TL-WR841N IPv6 WAN Configuration Gateway os command injection

Summaryinfo

A vulnerability classified as very critical was found in TP-Link TL-WR841N. The affected element is an unknown function of the component IPv6 WAN Configuration. Such manipulation of the argument Gateway leads to os command injection. This vulnerability is listed as CVE-2026-102294. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in TP-Link TL-WR841N (version unknown). It has been rated as very critical. Affected by this issue is an unknown function of the component IPv6 WAN Configuration. The manipulation of the argument Gateway with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands.  Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration or services, and disruption of device operation.

The advisory is shared for download at tp-link.com. This vulnerability is handled as CVE-2026-102294 since 09/28/2026. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/01/2026). The MITRE ATT&CK project declares the attack technique as T1202.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• TP-Link

Name

• TL-WR841N

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion