Command Injection Vulnerability in Multiple TP-Link Router Models

CVE-2026-11834

What is CVE-2026-11834?

A command injection vulnerability has been discovered in the DHCP option processing of various TP-Link router models, stemming from inadequate validation of DHCP option data supplied externally. An adjacent attacker could exploit this flaw by sending specially crafted DHCP responses, which might lead to unauthorized command execution during the device's initialization or provisioning phase. This exposure primarily affects devices operating in their factory-default or unconfigured states. If successfully exploited, this vulnerability may enable an adjacent, unauthenticated attacker to execute arbitrary commands with elevated privileges, allowing potential full compromise of the affected device and unauthorized administrative access.

References