ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-102294

Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration

CVSS 4.0 8.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-102294

Published

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration or services, and disruption of device operation.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-102294

Published

TL-WR841N v14

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "TP-Link System Inc.",
                    "product": "TL-WR841N v14",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "4.19 Build 260821 (EN)",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "4.19 Build 260820 (US)",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON