{"affected":[{"defaultStatus":"unaffected","product":"Archer MR600 v5","source":"CNA: TPLink","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"EU_V5_1.7.0 0.9.1 260518 rel67803","status":"affected","version":"0","versionType":"custom"},{"lessThan":"JP_V5_1.2.0 0.9.1 260519 rel52362","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Archer MR600 v2","source":"CNA: TPLink","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.12.0 Build 260826","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Archer MR600 v3","source":"CNA: TPLink","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.4.0 Build 260827","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-8913","cwes":["CWE-78"],"description":"A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.","epss":{"date":"2026-11-03","percentile":0.59941,"score":0.00907},"exploits":[],"kev":null,"metrics":[{"score":8.5,"severity":"high","source":"CNA: TPLink","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793735340963,"publishedAt":1780939305936,"references":[{"source":"CNA: TPLink","tags":["patch"],"url":"https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware"},{"source":"CNA: TPLink","tags":["patch"],"url":"https://www.tp-link.com/jp/support/download/archer-mr600/v5/#Firmware"},{"source":"CNA: TPLink","tags":["vendor-advisory"],"url":"https://www.tp-link.com/us/support/faq/5122/"},{"source":"CNA: TPLink","tags":["patch"],"url":"https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware"},{"source":"CNA: TPLink","tags":["patch"],"url":"https://www.tp-link.com/en/support/download/archer-mr600/v3/#Firmware"}],"remediation":[{"kind":"fix","source":"CNA: TPLink","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware"},{"kind":"fix","source":"CNA: TPLink","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.tp-link.com/jp/support/download/archer-mr600/v5/#Firmware"},{"kind":"fix","source":"CNA: TPLink","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware"},{"kind":"fix","source":"CNA: TPLink","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.tp-link.com/en/support/download/archer-mr600/v3/#Firmware"}],"revision":"32be70c2d8f8abd1fb1fb5cecd5c2755c7dfbd52b10530b1eb1e06bcbe6c41a9","sources":[{"modifiedAt":1793735340963,"name":"CNA: TPLink","retrievedAt":1793736621450,"url":"https://www.cve.org/CVERecord?id=CVE-2026-8913"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793736625624,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-8913"}],"ssvc":{"assessedAt":1780876800000,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Command Injection in Archer MR600 WireGuard Client Configuration","updatedAt":1793736625624}