{"id":"CVE-2026-118865","kind":"vulnerability","aliases":["CVE-2026-118865"],"related":[],"title":"TP-Link Archer AX3000 v2: admin can run commands via USB download path","description":"An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command. \n\nSuccessful exploitation may allow arbitrary command execution on the affected device.","summary":"An authenticated administrator of the Archer AX3000 v2 router can enter a crafted path in the Offline Download feature when a USB storage device is attached. The path is passed to a system command without sanitizing shell characters, so the attacker can run arbitrary commands on the router.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Archer AX3000 v2","fixed":["1.1.3 Build 261026"],"affected":"V2 firmware before 1.1.3 Build 261026 (TP-Link lists only the fixed build)","ecosystem":"vendor"}],"ecosystems":[],"tags":["archer-ax3000","home-router","infrastructure","router-firmware","tp-link"],"not_affected_if":["no-offline-download","no-usb-storage","other-models"],"how_to_check":"- Find your hardware version (label on the router); only V2 is listed as affected.\n- In the router admin web interface, check the firmware version (System Tools > Firmware Upgrade). Anything older than 1.1.3 Build 261026 on V2 is not confirmed fixed.\n- Also check whether a USB storage device is attached and Offline Download is in use; the advisory does not say if it is on by default.","fix":"Update Archer AX3000 v2 to firmware 1.1.3 Build 261026 or later (US firmware from TP-Link's Archer AX3000 download page).","status":"open","published_at":"2026-11-03T22:19:29+00:00","first_seen_at":"2026-11-03T23:15:08+00:00","triaged_at":"2026-11-03T23:16:10+00:00","updated_at":"2026-11-03T23:17:15+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-03T23:16:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TP-Link Archer AX3000 v2: admin can run commands via USB download path","impact":"high","summary":"An authenticated administrator of the Archer AX3000 v2 router can enter a crafted path in the Offline Download feature when a USB storage device is attached. The path is passed to a system command without sanitizing shell characters, so the attacker can run arbitrary commands on the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["archer-ax3000","tp-link","home-router","router-firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary commands on the router as administrator.","analyst_note":"Confirm the fixed firmware version and whether Offline Download with USB is enabled by default; check the NVD entry and the TP-Link advisory.","how_to_check":"- Check the router firmware version in the admin web interface under System Tools > Firmware Upgrade, or the `unknown` version if the sources do not say.\n- Check whether the Offline Download feature with USB storage is in use: unknown.","plain_action":"Check your TP-Link Archer AX3000 v2 router for a firmware update, since the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["no-usb-storage","no-offline-download","other-models"],"who_is_affected":"Owners of the Archer AX3000 v2 router where a USB storage device is attached and the Offline Download feature is used. The attacker must already be logged in as an administrator, so the admin password must be protected. The sources do not say whether the feature is enabled by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000722,"input_tokens":4145,"output_tokens":615,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether Offline Download with USB is enabled by default; check the NVD entry and the TP-Link advisory.","search":"'-118865':17A,20A '-2026':16A,19A 'admin':7A 'administr':39B,113C 'affect':144C 'alloc':99C 'allow':138C 'arbitrari':80B,139C 'archer':4A,21A,25B,42B,101C 'archer-ax3000':24B 'attach':62B,110C 'attack':77B 'authent':38B,86C,112C 'ax3000':5A,22A,26B,43B,102C 'charact':74B 'command':10A,70B,81B,88C,134C,140C 'compon':96C 'contain':120C 'craft':49B,117C 'cve':15A,18A 'devic':60B,108C,145C 'download':13A,54B,95C 'enter':47B 'execut':141C 'exist':91C 'exploit':136C 'featur':55B 'firmwar':33B 'home':28B 'home-rout':27B 'infrastructur':30B 'inject':89C 'link':3A,36B 'may':137C 'metacharact':122C 'neutral':127C 'offlin':53B,94C 'os':87C 'pass':66B,130C 'path':14A,50B,64B,118C 'proper':126C 'router':29B,32B,45B,84B 'router-firmwar':31B 'run':9A,79B 'sanit':72B 'shell':73B,121C 'storag':59B,98C,107C 'submit':115C 'success':135C 'system':69B,133C 'tp':2A,35B 'tp-link':1A,34B 'usb':12A,58B,97C,106C 'v2':6A,23A,44B,103C 'valu':119C 'via':11A 'vulner':90C 'without':71B","nicknames":[],"mitigations":[],"who_affected":"Owners of the TP-Link Archer AX3000 hardware version V2 with a USB storage device attached, where an attacker already has administrator access (the CVSS vector is adjacent network, high privileges). Other hardware versions are not listed by TP-Link. The advisory does not say whether Offline Download is enabled by default. Routers without USB storage or without Offline Download can likely skip it, but update anyway.","tier":"B","verified":{"fix":{"at":"2026-11-03T23:17:15Z","by":"analyst","doc":"https://www.tp-link.com/us/support/faq/5380/","run_id":1575},"products":{"at":"2026-11-03T23:17:15Z","by":"analyst","doc":"https://www.tp-link.com/us/support/faq/5380/","run_id":1575},"how_to_check":{"at":"2026-11-03T23:17:15Z","by":"analyst","doc":"https://www.tp-link.com/us/support/faq/5380/","run_id":1575},"who_affected":{"at":"2026-11-03T23:17:15Z","by":"analyst","doc":"https://www.tp-link.com/us/support/faq/5380/","run_id":1575}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your TP-Link Archer AX3000 (V2) router to firmware 1.1.3 Build 261026 or newer from the TP-Link support website.","pkeys":["archerax3000v2","ax3000v2"],"ptokens":["archer","ax3000","v2"],"labels":["archerax3000","high","homerouter","infrastructure","routerfirmware","tplink"],"campaign_type":null,"first_public_at":"2026-11-03T22:19:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118865","severity":null,"published_at":"2026-11-03T22:19:29+00:00","modified_at":"2026-11-03T22:19:29+00:00","first_seen_at":"2026-11-03T23:15:08+00:00","fetched_at":"2026-11-03T23:15:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118865:1575","url":null,"severity":null,"published_at":"2026-11-03T23:17:15+00:00","modified_at":"2026-11-03T23:17:15+00:00","first_seen_at":"2026-11-03T23:17:15+00:00","fetched_at":"2026-11-03T23:17:15+00:00","note":"Read TP-Link advisory FAQ 5380: fixed in Archer AX3000 v2 firmware 1.1.3 Build 261026. Advisory does not say whether Offline Download is on by default, nor list affected builds; no exploitation or PoC found."}],"documents":[{"id":61474,"url":"https://www.tp-link.com/us/support/faq/5380/","title":"TP-Link Security Advisory CVE-2026-118865 (Archer AX3000 v2)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}