PT-2026-50084 · Tp Link Systems · Tl-Wr940N V6

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-11410

Mitre

CVSS v4.0

8.5

High

Base vector

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-11410

Affected Products

Tl-Wr940N V6

References · 3

• https://tp-link.com/en/support/download/tl-wr940n/v6/#Firmware · Patch
• https://tp-link.com/us/support/download/tl-wr940n/v6/#Firmware · Patch
• https://tp-link.com/us/support/faq/5131 · Vendor Advisory