OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N

A flaw in the TP-Link TL-WR940N router allows an administrator to inject malicious system commands through the IPv6 PPPoE settings due to poor input validation. An attacker with admin access could run any command on the device with full control.

OS command injection vulnerability in the IPv6 PPPoE configuration handler of TP-Link TL-WR940N v6 stemming from insufficient input sanitization. An authenticated attacker can craft malicious input to execute arbitrary system commands with elevated privileges; the attack vector requires administrative credentials and affects the integrity and confidentiality of the device and network.