CVE-2026-118865highCWE-78

CVE-2026-118865: high-severity vulnerability in TP-Link Systems Inc. Archer AX3000 v2

Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component

Published · Updated

Follow this CVE+ Monitor Archer AX3000

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3
An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command.  Successful exploitation may allow arbitrary command execution on the affected device.
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
TP-Link Systems Inc. · Archer AX3000 v2