Live › vulnerability › CVE-2026-118865
An authenticated administrator of the Archer AX3000 v2 router can enter a crafted path in the Offline Download feature when a USB storage device is attached. The path is passed to a system command without sanitizing shell characters, so the attacker can run arbitrary commands on the router.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:15 UTC. All times on this page are UTC.
Owners of the TP-Link Archer AX3000 hardware version V2 with a USB storage device attached, where an attacker already has administrator access (the CVSS vector is adjacent network, high privileges). Other hardware versions are not listed by TP-Link. The advisory does not say whether Offline Download is enabled by default. Routers without USB storage or without Offline Download can likely skip it, but update anyway.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Archer AX3000 v2 | vendor | V2 firmware before 1.1.3 Build 261026 (TP-Link lists only the fixed build) | 1.1.3 Build 261026 |
Update Archer AX3000 v2 to firmware 1.1.3 Build 261026 or later (US firmware from TP-Link's Archer AX3000 download page).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command.
Successful exploitation may allow arbitrary command execution on the affected device.
This page as .md · .json · in your agent: get_signal("CVE-2026-118865")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.