CVE-2026-9030

Received Received - Intake

Denial-of-Service in TP-Link Archer A6 v4 httpd Service

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: TPLink

Description

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path, successful exploitation may cause the httpd process or device management service to crash and may result in temporary loss of access to the web management interface or device reboot.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-9030

EUVD

EUVD-2026-54655

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service issue in the httpd service of Archer A6 v4 devices. It occurs because the system does not properly handle concurrent systool operations, leading to crashes when crafted instructions are sent through asynchronous requests.

Detection Guidance

This vulnerability may cause the httpd process or device management service to crash. Monitor for crashes or unresponsiveness in the web management interface. Check system logs for abnormal httpd behavior or unexpected systool instruction sequences.

Impact Analysis

Exploitation may cause the httpd process or device management service to crash, resulting in temporary loss of access to the web management interface or forcing a device reboot.

Compliance Impact

This vulnerability causes temporary loss of access to the web management interface or device reboot due to a denial-of-service condition. Such disruptions could impact compliance with standards requiring continuous availability of critical systems, such as GDPR's requirement for timely data access or HIPAA's need for reliable system operations.

Mitigation Strategies

Apply vendor patches or updates for Archer A6 v4 httpd service. Restrict access to the web management interface to trusted networks or IPs. Monitor for unusual activity and disable unnecessary services if possible.

Hi! I’m here to help you understand CVE-2026-9030. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70