Is CVE-2026-109683 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109683 being exploited in the wild.

How severe is CVE-2026-109683?

Informational severity, published 6 November 2026.

Is there a fix for CVE-2026-109683?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109683 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-109683?

Check whether you run TP-Link Archer BE805 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109683: TP-Link Archer BE805 UPnP newline injection

CVE-2026-109683 · Severity: info · Published 2026-11-06

The TP-Link Archer BE805 Wi-Fi 7 router contains a newline injection vulnerability in its UPnP service that allows attackers on the local network to modify port-mapping descriptions. An attacker can inject malicious newline characters to create spoofed UPnP port-mapping entries, potentially confusing users about network traffic routing. The attack requires only local network access and does not enable code execution or privilege escalation, limiting the impact to data integrity.

Vendors: TP-Link.

Quick answers

Is CVE-2026-109683 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109683 being exploited in the wild.
How severe is CVE-2026-109683?: Informational severity, published 6 November 2026.
Which products and versions are affected?: TP-Link Archer BE805 v1.
Is there a fix for CVE-2026-109683?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109683 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-109683?: Check whether you run TP-Link Archer BE805 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A newline injection flaw in the Archer BE805 v1 UPnP service fails to sanitize user-supplied input in port-mapping descriptions, allowing an adjacent network attacker to inject newline characters. This enables corruption or spoofing of UPnP port-mapping data stored on the device. The vulnerability is reachable without authentication from any device on the local network, though it does not result in code execution or system compromise.

Affected products

TP-Link Archer BE805 v1

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.