CVE-2026-11410: high-severity vulnerability in TP-Link Systems Inc. TL-WR940N v6
OS Command Injection in BigPond Cable (BPA) Configuration in TP-Link TL-WR940N
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A TP-Link TL-WR940N router has a security flaw in its internet configuration settings that lets someone with admin access run any command on the device. This could allow an attacker to take complete control of your router.
OS command injection vulnerability in the BigPond Cable (BPA) WAN configuration module exploitable by authenticated administrators through unsanitized user input, enabling arbitrary command execution with elevated privileges on the affected router.
In the same product, most dangerous first.