Is CVE-2026-3227 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3227 being exploited in the wild.

How severe is CVE-2026-3227?

Medium severity, with a CVSS score of 6.8, published 16 March 2026.

Which products and versions are affected?

TP-Link Tl-Wr802n Before V4_260304; TP-Link Tl-Wr840n Before V6_260304; TP-Link TL-WR841N Before V14_260303.

Is there a fix for CVE-2026-3227?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-3227 attacked?

It is attacked from the adjacent network, in device firmware.

Am I affected by CVE-2026-3227?

Check whether you run TP-Link Tl-Wr802n, TP-Link Tl-Wr802n Firmware, TP-Link Tl-Wr840n or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3227: TP-Link Multiple Routers OS command injection in configuration import

CVE-2026-3227 · Severity: medium · CVSS 6.8 · Published 2026-03-16

A security vulnerability exists in several TP-Link router models that could allow an authorized user to take complete control of the device. By uploading a specially crafted configuration file, an attacker can bypass security restrictions to run unauthorized commands with the highest level of system access. This could lead to the theft of network traffic, interception of data, or a total disruption of internet services.

Technologies: TP-Link TL-WR841N. Vendors: TP-Link.

Quick answers

Is CVE-2026-3227 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3227 being exploited in the wild.
How severe is CVE-2026-3227?: Medium severity, with a CVSS score of 6.8, published 16 March 2026.
Which products and versions are affected?: TP-Link Tl-Wr802n Before V4_260304; TP-Link Tl-Wr840n Before V6_260304; TP-Link TL-WR841N Before V14_260303.
Is there a fix for CVE-2026-3227?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3227 attacked?: It is attacked from the adjacent network, in device firmware.
Am I affected by CVE-2026-3227?: Check whether you run TP-Link Tl-Wr802n, TP-Link Tl-Wr802n Firmware, TP-Link Tl-Wr840n or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the configuration import function of TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6. The flaw is caused by improper neutralization of special elements during the processing of port-trigger settings within a configuration file. An authenticated attacker with high privileges can exploit this by uploading a malicious configuration file, leading to the execution of arbitrary system commands as root. This results in full device compromise. Firmware updates have been released to address this issue.

Affected products

TP-Link TL-WR802N v4 Before V4_260304
TP-Link TL-WR841N v14 Before V14_260303
TP-Link TL-WR840N v6 Before V6_260304

Timeline

2026-03-16: disclosed
2026-03-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.