CVE-2026-15428

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges.

Successful exploitation may allow remote code execution and complete compromise of the device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
TP-Link Systems Inc.	Archer VX1800v v1	< 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n

References

https://www.tp-link.com/en/support/download/archer-vx1800v/#FirmwareProduct
https://www.tp-link.com/us/support/faq/5189/Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-154298.8A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled CVE-2026-15436.4The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, CVE-2026-154306.2Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unpr CVE-2026-154317.3A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability CVE-2026-154325.9When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potential CVE-2026-154359.8IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories CVE-2026-154396.5The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integratio CVE-2026-15448.8A security flaw has been discovered in D-Link DIR-823X 250416. Impacted is the function sub_41E2A0 of the file /goform/set_mode. Performing CVE-2026-154415.3The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll CVE-2026-154425.3In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could CVE-2026-154444.9The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' param CVE-2026-154454.9The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and includ