CVE-2026-11409: high-severity vulnerability in TP-Link Systems Inc. TL-WR940N v6
OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in the TP-Link TL-WR940N router allows an administrator to inject malicious system commands through the IPv6 PPPoE settings due to poor input validation. An attacker with admin access could run any command on the device with full control.
OS command injection vulnerability in the IPv6 PPPoE configuration handler of TP-Link TL-WR940N v6 stemming from insufficient input sanitization. An authenticated attacker can craft malicious input to execute arbitrary system commands with elevated privileges; the attack vector requires administrative credentials and affects the integrity and confidentiality of the device and network.
In the same product, most dangerous first.