CVE-2026-75616

HIGH 8.5

Published 2026-08-19 · Last modified 2026-08-20

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise. Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it.

ELEVATED IMPACT

Severe if exploited (CVSS 8.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

1.9%chance of exploitation in 30 days · 78th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

8.5CVSS 4.0 · HIGH

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

⚠Access: Must sit on the same / adjacent network
⚠Privileges: Requires an admin / high-privilege account
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable
✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

github-search Search GitHub for public PoC repos

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-75616/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-75616/poc.json

Affected

Vendors Tp Link Systems Inc.

Products Archer C20 V6

Weakness (CWE)

CWE-78: Improper neutralization of special elements used in an OS command ('OS command injection')

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

All CVSS metrics

HIGH 8.5 v4.0 · CNA Primary
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
HIGH 8.5 v4.0 · NVD Secondary
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X