CVE-2026-3227
Command Injection in TP-Link Routers Allows Root Execution
Publication date: 2026-03-16
Last updated on: 2026-04-07
Assigner: TPLink
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tp-link | tl-wr802n_firmware | to 260304 (exc) |
| tp-link | tl-wr841n_firmware | to 260303 (exc) |
| tp-link | tl-wr840n_firmware | to 260304 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-3227 is a command injection vulnerability found in certain TP-Link router models: TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6. The issue arises because the router's configuration import function does not properly neutralize special characters used in operating system commands."}, {'type': 'paragraph', 'content': 'An authenticated attacker can exploit this by uploading a specially crafted configuration file. This triggers the execution of arbitrary OS commands with root privileges during the port-trigger processing phase.'}, {'type': 'paragraph', 'content': 'Successful exploitation results in full device compromise, allowing the attacker to execute system commands with the highest level of access.'}] [2]
How can this vulnerability impact me? :
This vulnerability allows an authenticated attacker to execute arbitrary system commands with root privileges on affected TP-Link routers.
The impact includes full compromise of the device, meaning the attacker can control the router completely, potentially intercepting or manipulating network traffic, disrupting network services, or using the device as a foothold for further attacks.
Because the attacker gains root-level access, the security, integrity, and availability of the device and connected network can be severely affected.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, TP-Link strongly recommends updating affected devices to the latest firmware versions.
The affected models and their firmware versions to update to are:
- TL-WR802N (v4) to firmware version V4_260304 or later
- TL-WR841N (v14) to firmware version V14_260303 or later
- TL-WR840N (v6) to firmware version V6_260304 or later
Failure to apply these updates leaves devices vulnerable to root-level command execution and full compromise.