CVE-2026-78541
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-78
Neutralización incorrecta de elementos especiales usados en un comando de sistema operativo (Inyección de comando de sistema operativo)
Fecha de publicación:
24/08/2026
Última modificación:
25/08/2026
Descripción
*** Pendiente de traducción *** A stored OS<br />
command injection vulnerability exists in the parent-control module of TP-Link<br />
Archer BE3600 V1. An authenticated adjacent attacker with administrative access<br />
may store a crafted profile name containing shell metacharacters, which is<br />
later processed unsafely during daily cloud report generation and may result in<br />
arbitrary command execution.<br />
<br />
<br />
<br />
<br />
<br />
Successful<br />
exploitation may allow command execution on the affected device with potential<br />
impact to device confidentiality, integrity, and availability.
Impacto
Puntuación base 4.0
8.50
Gravedad 4.0
ALTA