CVE-2026-118865

UNKNOWN 0.0

Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command. Successful exploitation may allow arbitrary command execution on the affected device.

CWE	CWE-78
Vendor	tp-link systems inc.
Product	archer ax3000 v2
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for tp-link systems inc. archer ax3000 v2

Be the first to know when new unknown vulnerabilities affecting tp-link systems inc. archer ax3000 v2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

TP-Link Systems Inc. / Archer AX3000 v2

0 < 1.1.3 Build 261026

References

NVD ↗ CVE.org ↗ EPSS Data ↗

tp-link.com: https://www.tp-link.com/us/support/download/archer-ax3000/v2.60/#Firmware tp-link.com: https://www.tp-link.com/us/support/faq/5380/

Credits

Xingcan Chen of Alipay Security Team