---
id: "CVE-2026-109683"
page: "https://infrastack.ai/live/CVE-2026-109683"
kind: "vulnerability"
aliases: ["CVE-2026-109683"]
title: "TP-Link Archer BE805 router: UPnP newline injection spoofs port-mapping entries"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["archer-be805", "home-router", "infrastructure", "tp-link", "upnp"]
not_affected_if: ["different-model", "no-local-attacker", "upnp-disabled"]
published_at: "2026-11-06T20:17:09+00:00"
first_seen_at: "2026-11-06T20:43:59+00:00"
updated_at: "2026-11-06T20:44:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109683", "first_seen_at": "2026-11-06T20:43:59+00:00"}]
exploit_sources: []
---

# TP-Link Archer BE805 router: UPnP newline injection spoofs port-mapping entries

Link for people: https://infrastack.ai/live/CVE-2026-109683 (this .md is for agents)

The UPnP service on the TP-Link Archer BE805 v1 router does not sanitize newline characters in port-mapping descriptions. A nearby attacker on the local network can inject unintended content and create spoofed UPnP port-mapping entries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the device is an Archer BE805 v1 router (model label on the device or in the admin page).
- Check whether UPnP is enabled in the router's admin settings.

## Timeline

- 2026-11-06T20:43:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109683

## From the sources

A newline
injection vulnerability exists in the UPnP service of Archer BE805 v1 such that
an adjacent attacker can supply newline characters in a UPnP port-mapping
description due to improper sanitization, resulting in possible injection of unintended
content into UPnP port-mapping data.









Successful
exploitation may allow an unauthenticated attacker on the local network to
modify runtime UPnP port-mapping information and create spoofed entries within
the affected service. The issue is limited to the integrity of UPnP mapping
data and does not demonstrate code execution or privilege escalation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_