Description
An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command. 

Successful exploitation may allow arbitrary command execution on the affected device.
Published: 2026-11-03
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 22:15:00 +0000

Type Values Removed Values Added
Description An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command.  Successful exploitation may allow arbitrary command execution on the affected device.
Title Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published:

Updated: 2026-11-03T21:56:54.677Z

Reserved: 2026-10-29T00:25:27.898Z

Link: CVE-2026-118865

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-03T22:19:29.073

Modified: 2026-11-03T22:19:29.073

Link: CVE-2026-118865

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T08:30:12Z

Weaknesses