OS Command Injection Vulnerability in TP-Link Archer C20 Web Management Interface
CVE-2026-75616

8.5HIGH

Key Information:

Vendor: Tp-link Systems Inc.
Status: Archer C20 V6
Vendor: CVE Published:; 19 August 2026

🔔 Create Tp-link Systems Inc. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-75616?

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when handling specific WAN-related configuration operations. An authenticated administrator can exploit this issue due to inadequate input validation, enabling them to execute arbitrary system commands with elevated privileges. This could result in a complete compromise of the device, thus jeopardizing the confidentiality, integrity, and availability of not only the device itself but also the network traffic traversing through it. It is essential for users to apply available patches and updates to mitigate this risk.

Affected Version(s)

Archer C20 v6 Linux 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-75616
Created by totekuh