Newline Injection Vulnerability in Archer BE805 UPnP Service by TP-Link

CVE-2026-109683

What is CVE-2026-109683?

A newline injection vulnerability exists in the UPnP service of TP-Link's Archer BE805 v1, enabling an adjacent attacker on the local network to exploit the improper sanitization of newline characters. This can lead to the manipulation of UPnP port-mapping data, allowing unauthorized modification of runtime information and potentially creating spoofed entries in the mapping data. Although this issue compromises the integrity of UPnP mappings, it does not lead to code execution or privilege escalation.

References