# CVE-2026-11410: TP-Link TL-WR940N OS command injection in BPA configuration

Source: https://junglewise.ai/threats/cve-2026-11410-tp-link-tl-wr940n-os-command-injection-in-bpa-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

CVE-2026-11410 · Severity: info · CVSS 8.5 · Published 2026-06-17

A security vulnerability has been identified in the TP-Link TL-WR940N v6 wireless router, a device used to provide internet connectivity in homes and small offices. An attacker with administrative access to the router's management interface can execute unauthorized system commands by exploiting a flaw in the BigPond Cable (BPA) configuration settings. This could allow an attacker to take full control of the device, potentially leading to data interception, network disruption, or further attacks on connected devices.

Technologies: [TP-Link TL-WR940N v6](https://junglewise.ai/threats/technologies/tl-wr940n). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-11410 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11410 being exploited in the wild.

**How severe is CVE-2026-11410?** Informational severity, with a CVSS score of 8.5, published 17 June 2026.

**Which products and versions are affected?** TP-Link TL-WR940N v6 before V6_260528.

**Is there a fix for CVE-2026-11410?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11410 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-11410?** Check whether you run TP-Link TL-WR940N v6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module of the TP-Link TL-WR940N v6 router. The flaw is caused by improper sanitization of user-supplied parameters within the web management interface, which are subsequently used to construct system commands. An attacker with high privileges (administrative access) can exploit this via the adjacent network to execute arbitrary system commands with elevated privileges. This can result in a total compromise of confidentiality, integrity, and availability. TP-Link has released firmware version V6_260528 to address this issue, though the device is noted as reaching end-of-life (EOL).

## Affected products

- TP-Link TL-WR940N v6 before V6_260528

## Timeline

- 2026-06-16: advisory: TP-Link published security advisory
- 2026-06-17: disclosed: NVD publication date

## References

- [https://www.tp-link.com/en/support/download/tl-wr940n/v6/](https://www.tp-link.com/en/support/download/tl-wr940n/v6/)
- [https://www.tp-link.com/us/support/download/tl-wr940n/v6/](https://www.tp-link.com/us/support/download/tl-wr940n/v6/)
- [https://www.tp-link.com/us/support/faq/5131/](https://www.tp-link.com/us/support/faq/5131/)