# CVE-2026-102294: TP-Link TL-WR841N OS command injection in IPv6 WAN configuration

Source: https://junglewise.ai/threats/cve-2026-102294-tp-link-tl-wr841n-contains-an-authenticated-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-102294 · Severity: info · Published 2026-10-01

The TP-Link TL-WR841N is a wireless router used in home and small-office networks. An authenticated administrator can inject arbitrary operating system commands through a malformed IPv6 Gateway setting in the WAN configuration, potentially enabling unauthorized access to device data, configuration tampering, and network disruption.

Technologies: [TP-Link TL-WR841N](https://junglewise.ai/threats/technologies/tl-wr841n). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-102294 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102294 being exploited in the wild.

**How severe is CVE-2026-102294?** Informational severity, published 1 October 2026.

**Which products and versions are affected?** TP-Link TL-WR841N V14 and earlier.

**Is there a fix for CVE-2026-102294?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102294 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-102294?** Check whether you run TP-Link TL-WR841N at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the IPv6 WAN configuration module where user-supplied IPv6 Gateway values are incorporated into system commands without proper sanitization. An authenticated administrator can exploit this by crafting a malicious IPv6 Gateway input to execute arbitrary commands on the device. The vulnerability requires administrative authentication but allows full command execution at the OS level.

## Affected products

- TP-Link TL-WR841N V14 and earlier

## Timeline

- 2026-10-01: disclosed

## References

- [https://www.tp-link.com/en/support/download/tl-wr841n/v14/](https://www.tp-link.com/en/support/download/tl-wr841n/v14/)
- [https://www.tp-link.com/us/support/download/tl-wr841n/v14/](https://www.tp-link.com/us/support/download/tl-wr841n/v14/)

## Related threats

- [TP-Link TL-WR841N buffer overflow in HTTP service](https://junglewise.ai/threats/cve-2026-76651-tp-link-tl-wr841n-buffer-overflow-in-http-service)
- [TP-Link TL-WR841N v14 NULL pointer dereference in UPnP](https://junglewise.ai/threats/cve-2026-76650-tp-link-tl-wr841n-v14-null-pointer-dereference-in-upnp)
- [TP-Link TL-WR841N NULL pointer dereference in UPnP service](https://junglewise.ai/threats/cve-2026-76649-tp-link-tl-wr841n-null-pointer-dereference-in-upnp-service)
- [TP-Link TL-WR841N stack overflow in web management interface](https://junglewise.ai/threats/cve-2026-9105-tp-link-tl-wr841n-stack-overflow-in-web-management-interface)
- [TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from…](https://junglewise.ai/threats/cve-2026-5039-tp-link-tl-wr841n-v13-uses-des-cbc-encryption-in-the-tddpv2-debug)