Is CVE-2026-11409 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11409 being exploited in the wild.

How severe is CVE-2026-11409?

Informational severity, with a CVSS score of 8.5, published 17 June 2026.

Which products and versions are affected?

TP-Link TL-WR940N Before V6_260528.

Is there a fix for CVE-2026-11409?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11409 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-11409?

Check whether you run TP-Link TL-WR940N at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11409: TP-Link TL-WR940N v6 command injection in IPv6 PPPoE handler

CVE-2026-11409 · Severity: info · CVSS 8.5 · Published 2026-06-17

A security vulnerability exists in the TP-Link TL-WR940N v6 wireless router, a device used to provide internet connectivity in homes and small offices. An attacker who has already gained administrative access to the router's management interface can take complete control of the device by injecting malicious commands through the IPv6 configuration settings. This could lead to the theft of sensitive information, modification of network traffic, or a total disruption of internet service.

Technologies: TP-Link TL-WR940N. Vendors: TP-Link.

Quick answers

Is CVE-2026-11409 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11409 being exploited in the wild.
How severe is CVE-2026-11409?: Informational severity, with a CVSS score of 8.5, published 17 June 2026.
Which products and versions are affected?: TP-Link TL-WR940N Before V6_260528.
Is there a fix for CVE-2026-11409?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11409 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-11409?: Check whether you run TP-Link TL-WR940N at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the IPv6 PPPoE configuration handler of the TP-Link TL-WR940N v6 router. The flaw is caused by improper sanitization of user-supplied input within the WAN configuration module, where parameters are directly incorporated into system command execution. An attacker with high-privileged (administrative) credentials can exploit this via the web management interface from an adjacent network. Successful exploitation allows for arbitrary command execution with elevated privileges, potentially leading to full system compromise. TP-Link has released firmware version V6_260528 to address this issue, though the device is noted as reaching end-of-life (EOL).

Affected products

TP-Link TL-WR940N v6 Before V6_260528

Timeline

2026-06-16: advisory: TP-Link published the security advisory.
2026-06-17: disclosed: CVE published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.