Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2026-11834 EUVD-2026-38339GHSA-w296-94hj-pfcg

Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers

Published Jun 22, 2026 · Updated Jun 26, 2026 · Assigned by TPLink

Vendor: TP-Link Systems Product: Archer C20 v5 Product: Archer C20 v6 Product: Archer MR200 v07 Product: Archer MR200 v8 Product: Archer MR402 v1 Product: Archer VR2100 v1 Product: TL-MR6400 v7 Category: Network devices

Description

A command
injection vulnerability has been identified in the DHCP option processing logic
in multiple TP-Link router models, due to insufficient validation of externally
supplied DHCP option data. An adjacent attacker may exploit this
vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized
command execution during device initialization or provisioning workflows. This
typically occurs when the device is in a factory-default or unconfigured state.

Successful
exploitation may allow an adjacent, unauthenticated attacker to execute
arbitrary commands with elevated privileges, potentially leading to full
compromise of the affected device and unauthorized administrative control.

Affected products

VendorProductAffectedFixed
TP-Link Systems Archer MR200 v07 < 1.3.0 Build 250605 1.3.0 Build 250605
TP-Link Systems Archer MR200 v8 < 1.5.0 Build 260605 1.5.0 Build 260605
TP Link Systems Archer MR402 v1 < 1.5.0 Build 260605 1.5.0 Build 260605
TP-Link Systems Archer VR2100 v1 < EU_V1_260330 EU_V1_260330
TP-Link Systems Archer C20 v5 < EU_V5_260317, < US_V5_260419 EU_V5_260317
TP-Link Systems Archer C20 v6 < V6_260608 V6_260608
TP-Link Systems TL-MR6400 v7 < 1.7.0 Build 260413 1.7.0 Build 260413

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • mattgsys/CVE-2026-11834 ★ 6 · Jun 23, 2026

    Proof of Concept (PoC) for the TP-Link DHCP Option 66 Unauthenticated RCE (CVE-2026-11834)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References