{"id":"CVE-2026-109683","kind":"vulnerability","aliases":["CVE-2026-109683"],"related":[],"title":"TP-Link Archer BE805 router: UPnP newline injection spoofs port-mapping entries","description":"A newline\ninjection vulnerability exists in the UPnP service of Archer BE805 v1 such that\nan adjacent attacker can supply newline characters in a UPnP port-mapping\ndescription due to improper sanitization, resulting in possible injection of unintended\ncontent into UPnP port-mapping data.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker on the local network to\nmodify runtime UPnP port-mapping information and create spoofed entries within\nthe affected service. The issue is limited to the integrity of UPnP mapping\ndata and does not demonstrate code execution or privilege escalation.","summary":"The UPnP service on the TP-Link Archer BE805 v1 router does not sanitize newline characters in port-mapping descriptions. A nearby attacker on the local network can inject unintended content and create spoofed UPnP port-mapping entries.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["archer-be805","home-router","infrastructure","tp-link","upnp"],"not_affected_if":["different-model","no-local-attacker","upnp-disabled"],"how_to_check":"- Confirm the device is an Archer BE805 v1 router (model label on the device or in the admin page).\n- Check whether UPnP is enabled in the router's admin settings.","fix":null,"status":"open","published_at":"2026-11-06T20:17:09+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","triaged_at":"2026-11-06T20:44:23+00:00","updated_at":"2026-11-06T20:44:23+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T20:44:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TP-Link Archer BE805 router: UPnP newline injection spoofs port-mapping entries","impact":"low","summary":"The UPnP service on the TP-Link Archer BE805 v1 router does not sanitize newline characters in port-mapping descriptions. A nearby attacker on the local network can inject unintended content and create spoofed UPnP port-mapping entries.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["tp-link","archer-be805","upnp","home-router"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker on local network creates spoofed UPnP port-mapping entries","analyst_note":"Confirm the fixed firmware version and UPnP default state from the TP-Link advisory; NVD text alone does not give them.","how_to_check":"- Confirm the device is an Archer BE805 v1 router (model label on the device or in the admin page).\n- Check whether UPnP is enabled in the router's admin settings.\n- unknown for a firmware version check, as the sources do not say which version is fixed.","plain_action":"Check whether your TP-Link Archer BE805 router has UPnP turned on, and turn it off if you do not need it; the sources do not state a patched firmware version.","needs_analyst":true,"not_affected_if":["upnp-disabled","different-model","no-local-attacker"],"who_is_affected":"Owners of the TP-Link Archer BE805 v1 router with UPnP enabled are exposed, and the attacker must be on the same local network. Networks where UPnP is disabled or the router is not this model can skip it. The sources say the flaw affects only the integrity of UPnP mapping data, with no code execution.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000756,"input_tokens":4325,"output_tokens":646,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109683':17A,20A '-2026':16A,19A 'adjac':89C 'affect':144C 'allow':122C 'archer':4A,22B,40B,83C 'archer-be805':21B 'attack':56B,90C,125C 'be805':5A,23B,41B,84C 'charact':48B,94C 'code':161C 'content':64B,112C 'creat':66B,139C 'cve':15A,18A 'data':118C,156C 'demonstr':160C 'descript':53B,101C 'due':102C 'entri':14A,72B,141C 'escal':165C 'execut':162C 'exist':77C 'exploit':120C 'home':25B 'home-rout':24B 'improp':104C 'inform':137C 'infrastructur':27B 'inject':9A,62B,75C,109C 'integr':152C 'issu':147C 'limit':149C 'link':3A,30B,39B 'local':59B,128C 'map':13A,52B,71B,100C,117C,136C,155C 'may':121C 'modifi':131C 'nearbi':55B 'network':60B,129C 'newlin':8A,47B,74C,93C 'port':12A,51B,70B,99C,116C,135C 'port-map':11A,50B,69B,98C,115C,134C 'possibl':108C 'privileg':164C 'result':106C 'router':6A,26B,43B 'runtim':132C 'sanit':46B,105C 'servic':34B,81C,145C 'spoof':10A,67B,140C 'success':119C 'suppli':92C 'tp':2A,29B,38B 'tp-link':1A,28B,37B 'unauthent':124C 'unintend':63B,111C 'upnp':7A,31B,33B,68B,80C,97C,114C,133C,154C 'v1':42B,85C 'vulner':76C 'within':142C","nicknames":[],"mitigations":[],"who_affected":"Owners of the TP-Link Archer BE805 v1 router with UPnP enabled are exposed, and the attacker must be on the same local network. Networks where UPnP is disabled or the router is not this model can skip it. The sources say the flaw affects only the integrity of UPnP mapping data, with no code execution.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Check whether your TP-Link Archer BE805 router has UPnP turned on, and turn it off if you do not need it; the sources do not state a patched firmware version.","pkeys":[],"ptokens":[],"labels":["archerbe805","homerouter","infrastructure","medium","tplink","upnp"],"campaign_type":null,"search_a":"'-109683':17A,20A '-2026':16A,19A 'archer':4A 'be805':5A 'cve':15A,18A 'entri':14A 'inject':9A 'link':3A 'map':13A 'newlin':8A 'port':12A 'port-map':11A 'router':6A 'spoof':10A 'tp':2A 'tp-link':1A 'upnp':7A","search_b":"'archer':22B,40B 'archer-be805':21B 'attack':56B 'be805':23B,41B 'charact':48B 'content':64B 'creat':66B 'descript':53B 'entri':72B 'home':25B 'home-rout':24B 'infrastructur':27B 'inject':62B 'link':30B,39B 'local':59B 'map':52B,71B 'nearbi':55B 'network':60B 'newlin':47B 'port':51B,70B 'port-map':50B,69B 'router':26B,43B 'sanit':46B 'servic':34B 'spoof':67B 'tp':29B,38B 'tp-link':28B,37B 'unintend':63B 'upnp':31B,33B,68B 'v1':42B","search_c":"'adjac':89C 'affect':144C 'allow':122C 'archer':83C 'attack':90C,125C 'be805':84C 'charact':94C 'code':161C 'content':112C 'creat':139C 'data':118C,156C 'demonstr':160C 'descript':101C 'due':102C 'entri':141C 'escal':165C 'execut':162C 'exist':77C 'exploit':120C 'improp':104C 'inform':137C 'inject':75C,109C 'integr':152C 'issu':147C 'limit':149C 'local':128C 'map':100C,117C,136C,155C 'may':121C 'modifi':131C 'network':129C 'newlin':74C,93C 'port':99C,116C,135C 'port-map':98C,115C,134C 'possibl':108C 'privileg':164C 'result':106C 'runtim':132C 'sanit':105C 'servic':81C,145C 'spoof':140C 'success':119C 'suppli':92C 'unauthent':124C 'unintend':111C 'upnp':80C,97C,114C,133C,154C 'v1':85C 'vulner':76C 'within':142C","first_public_at":"2026-11-06T20:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109683","severity":null,"published_at":"2026-11-06T20:17:09+00:00","modified_at":"2026-11-06T20:17:09+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:43:59+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}