# CVE-2026-15428: TP-Link Archer VX1800v OS command injection in domain name configuration

Source: https://junglewise.ai/threats/cve-2026-15428-tp-link-archer-vx1800v-os-command-injection-in-domain-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-15428 · Severity: info · CVSS 8.5 · Published 2026-07-14

A security vulnerability exists in the TP-Link Archer VX1800v v1 router, a device used to provide internet connectivity and Wi-Fi. An attacker on the same local network with administrative access can exploit a flaw in the domain name configuration settings to take full control of the device. If successful, the attacker could monitor network traffic, disrupt internet service, or use the compromised router as a foothold to attack other devices on the network.

Technologies: [TP-Link Archer VX1800v](https://junglewise.ai/threats/technologies/archer-vx1800v). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-15428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15428 being exploited in the wild.

**How severe is CVE-2026-15428?** Informational severity, with a CVSS score of 8.5, published 14 July 2026.

**Which products and versions are affected?** TP-Link Archer VX1800v < 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n.

**Is there a fix for CVE-2026-15428?** A patch was published on 2026-07-14: Firmware update released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15428 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-15428?** Check whether you run TP-Link Archer VX1800v at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in the TP-Link Archer VX1800v v1 due to insufficient input sanitization of the domain name parameter within the HTTP management interface. An attacker located on the adjacent network (local network) who possesses high-level administrative privileges can inject shell metacharacters into this parameter. This results in the execution of arbitrary system commands with root-level permissions. The vulnerability is addressed in firmware version 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n and later.

## Affected products

- TP-Link Archer VX1800v v1 < 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n

## Timeline

- 2026-07-14: disclosed: Advisory published by TP-Link and NVD record created.
- 2026-07-14: patched: Firmware update released to address the vulnerability.

## References

- [https://www.tp-link.com/en/support/download/archer-vx1800v/](https://www.tp-link.com/en/support/download/archer-vx1800v/)
- [https://www.tp-link.com/us/support/faq/5189/](https://www.tp-link.com/us/support/faq/5189/)

## Related threats

- [TP-Link Archer VX1800v privilege escalation in HTTP authentication](https://junglewise.ai/threats/cve-2026-15429-tp-link-archer-vx1800v-privilege-escalation-in-http)
- [TP-Link Archer VX1800v OS command injection in TR-069 interface](https://junglewise.ai/threats/cve-2026-15427-tp-link-archer-vx1800v-os-command-injection-in-tr-069-interface)