VULNERABILITY INTELLIGENCE

CVE-2026-11409

CVSS score7.2 HIGH
EPSS probability2.79%
CISA KEVNot currently listed
Published2026-06-17
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.

Weakness classification

  • f23511db-6c3e-4e32-a477-6aa17d310630: CWE-78

Primary references