Is CVE-2026-9254 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9254 being exploited in the wild.

How severe is CVE-2026-9254?

Informational severity, published 24 August 2026.

Which products and versions are affected?

TP-Link Archer AX75 V1; TP-Link Archer BE3600 V1; TP-Link Archer BE800 V1.

Is there a fix for CVE-2026-9254?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9254 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9254?

Check whether you run TP-Link Archer AX75, TP-Link Archer BE3600 or TP-Link Archer BE800 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9254: TP-Link Archer OS command injection in parental control

CVE-2026-9254 · Severity: info · Published 2026-08-24

TP-Link Archer routers include parental control functionality that filters internet access for specific devices. Due to improper input validation, an attacker on the local network can inject arbitrary commands that execute with root privileges, potentially compromising the router completely and intercepting all network traffic.

Technologies: TP-Link Archer BE3600. Vendors: TP-Link.

Quick answers

Is CVE-2026-9254 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9254 being exploited in the wild.
How severe is CVE-2026-9254?: Informational severity, published 24 August 2026.
Which products and versions are affected?: TP-Link Archer AX75 V1; TP-Link Archer BE3600 V1; TP-Link Archer BE800 V1.
Is there a fix for CVE-2026-9254?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9254 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9254?: Check whether you run TP-Link Archer AX75, TP-Link Archer BE3600 or TP-Link Archer BE800 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unauthenticated OS command injection vulnerability exists in the parental control functionality due to improper filtering and neutralization of special characters in certain parameters. The vulnerability is exploitable by a LAN-based attacker without authentication. Successful exploitation allows injection and execution of arbitrary commands with root privileges, leading to complete device compromise affecting confidentiality, integrity, and availability of the device and network traffic.

Affected products

TP-Link Archer BE800 V1
TP-Link Archer BE3600 V1
TP-Link Archer AX75 V1

Timeline

2026-08-24: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.