OS Command Injection Vulnerability in Archer AX3000 by TP-Link
CVE-2026-118865

7.3HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Archer Ax3000 V2
Vendor
CVE Published:
3 November 2026

What is CVE-2026-118865?

An OS command injection vulnerability has been identified in the Offline Download component of the Archer AX3000 v2. This vulnerability allows an authenticated administrator to manipulate path values containing shell metacharacters when a USB storage device is connected. If exploited, this could lead to arbitrary command execution on the device, potentially compromising its integrity and security. Users are advised to review security advisories and apply relevant patches to mitigate this risk.

Affected Version(s)

Archer AX3000 v2 Linux 0 < 1.1.3 Build 261026

References

https://www.tp-link.com/us/support/download/archer-ax3000...
patch
https://www.tp-link.com/us/support/faq/5380/
vendor-advisory

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Xingcan Chen of Alipay Security Team
.