CVE-2026-11410: OS Command Injection in BigPond Cable (BPA) Configuration in TP-Link TL-WR940N

Synopsis

An OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module of the TP-Link TL-WR940N v6 router. An attacker on the same local network segment with administrative credentials can inject arbitrary operating system commands through unsanitized input fields in the configuration interface. Successful exploitation grants execution of arbitrary commands with elevated privileges, enabling full device compromise including data disclosure, configuration tampering, and potential service disruption. A patched-image rebuild at version V6_260528 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be present on the same adjacent network, such as a LAN or VPN segment, to reach the device's administrative interface; remote internet-based exploitation is not possible without additional network access.

• AuthenticationRequired

  An administrative account is required; the attacker must already hold or obtain high-privilege credentials on the router before exploitation is possible.

• Victim interactionNot required

  No action from a logged-in user or any other person is needed; the attacker can trigger the injection entirely through their own requests to the configuration interface.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layouts, or environmental dependencies are required to inject and execute commands.

Blast Radius

• Reads device configuration data including stored credentials, WAN authentication tokens, and network topology details.
• Modifies router configuration including firewall rules, DNS settings, and routing tables, enabling traffic interception or redirection.
• Executes arbitrary OS commands with elevated privileges, allowing installation of persistent backdoors or malicious firmware components.
• Crashes or disrupts the routing and WAN services, cutting off internet connectivity for all devices on the affected network segment.