PT-2026-47442 · Tp Link Systems · Archer Mr600 V5

Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-8913

Mitre

CVSS v4.0

8.5

High

Base vector

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-8913

Affected Products

Archer Mr600 V5

References · 4

• https://tp-link.com/us/support/faq/5122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8913 · Security Note
• https://tp-link.com/jp/support/download/archer-mr600/v5/#Firmware · Patch
• https://tp-link.com/en/support/download/archer-mr600/v5/#Firmware · Patch