CVE-2026-11410

EUVD-2026-37498
An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 67%
Common Weakness Enumeration
References
https://www.tp-link.com/en/support/download/tl-wr940n/v6/#Firmware
https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware
https://www.tp-link.com/us/support/faq/5131/