TP-Link TL-WR841N: OS command injection in IPv6 WAN configuration
Summary
The TP-Link TL-WR841N v14 300Mbps wireless router contains an OS command injection flaw in its IPv6 WAN configuration. A crafted IPv6 Gateway value is passed unsanitized into a system command. An attacker with administrator credentials can execute arbitrary operating system commands, which may expose sensitive information, change device configuration or services, and disrupt operation. The attack vector is adjacent and not exploitable from the internet without valid admin access.
Affected
- TL-WR841N v14, EN firmware 0 to below 4.19 Build 260821
- TL-WR841N v14, US firmware 0 to below 4.19 Build 260820
- Default configuration is unaffected according to the vendor.
Fixed in
- Firmware 4.19 Build 260821 (EN) or later
- Firmware 4.19 Build 260820 (US) or later
- Download links are on the vendor advisory page.
Workaround
- No vendor workaround is known. Unknown whether TP-Link lists an interim workaround in the full advisory text.
- Replace default administrator passwords and limit who holds administrator access.
- Do not expose the management interface to the WAN and disable remote administration.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No known exploitation in the wild and not listed in the CISA KEV catalog.
- No public proof-of-concept found for this CVE at the time of research.
Our recommendation
- Identify all TL-WR841N v14 devices in your environment and check their firmware build.
- Update affected devices to the fixed build for your region as soon as possible.
- Change default admin credentials, restrict management access to the LAN and disable remote administration until patched.
- Consider replacing end-of-life hardware where an update is not possible.
- Verify with TP-Link whether the fix also covers the earlier CVE-2026-3227 in the same model.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TP-Link advisory (FAQ 5320) www.tp-link.com
- TP-Link firmware download (EN) www.tp-link.com
- TP-Link firmware download (US) www.tp-link.com
- TP-Link FAQ 5018 (earlier CVE-2026-3227) www.tp-link.com
- NVD mirror on Vulners vulners.com
- TheHackerWire CVE-2026-102294 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:36.
Original description (NVD)
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration or services, and disruption of device operation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.