CVE-2026-109683 · Infrastructure
NO FIX YET
The UPnP service on the TP-Link Archer BE805 v1 router does not sanitize newline characters in port-mapping descriptions. A nearby attacker on the local network can inject unintended content and create spoofed UPnP port-mapping entries.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Owners of the TP-Link Archer BE805 v1 router with UPnP enabled are exposed, and the attacker must be on the same local network. Networks where UPnP is disabled or the router is not this model can skip it. The sources say the flaw affects only the integrity of UPnP mapping data, with no code execution.
Not affected if different-model, no-local-attacker, upnp-disabled
Who cares archer-be805, home-router, tp-link, upnp
No fix yet, per the sources.
A newline injection vulnerability exists in the UPnP service of Archer BE805 v1 such that an adjacent attacker can supply newline characters in a UPnP port-mapping description due to improper sanitization, resulting in possible injection of unintended content into UPnP port-mapping data.
Successful exploitation may allow an unauthenticated attacker on the local network to modify runtime UPnP port-mapping information and create spoofed entries within the affected service. The issue is limited to the integrity of UPnP mapping data and does not demonstrate code execution or privilege escalation.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.