CVE-2026-11409: OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N

Synopsis

An OS command injection vulnerability affects the IPv6 PPPoE configuration handler in TP-Link TL-WR940N v6 firmware. The flaw is reachable from an adjacent network and requires administrative credentials; unsanitized input passed to the configuration handler is executed as system commands with elevated privileges. Successful exploitation gives an attacker full control of the device, including arbitrary command execution at the OS level. A patched-image rebuild at version V6_260528 is available on HarborGuard for environments running an affected firmware version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The vulnerable service is reachable from an adjacent network such as a local LAN or VPN segment; remote internet-based access alone is not sufficient.

• AuthenticationRequired

  An administrative account is required; the attacker must have already obtained router admin credentials before exploitation is possible.

• Victim interactionNot required

  No user interaction is needed; the attacker submits a crafted request directly to the configuration handler without any victim involvement.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker has network adjacency and admin credentials; no race conditions or special environmental factors are required.

Blast Radius

• Executes arbitrary OS commands with elevated privileges on the affected router, giving the attacker full control of the device.
• Reads any file accessible to the process, including stored credentials, PPPoE account details, and network configuration secrets.
• Modifies device configuration, firewall rules, or routing tables, enabling traffic interception or redirection for all hosts on the connected network.
• Crashes or reboots the device, disrupting network connectivity for every host that depends on it.