OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

An OS command
injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of
parameters, allowing crafted input to be executed as system-level commands.
Exploitation requires specific conditions such as TR-069 being enabled and ability
to influence ACS-delivered commands, compromise or control an ACS server.

Successful
exploitation may allow arbitrary command execution with root privileges,
resulting in complete compromise of the device.