CVE-2026-8913: Command Injection in TP-Link's Archer MR600 WireGuard Client Configuration

Synopsis

A command injection vulnerability exists in the WireGuard client configuration handler of the TP-Link Archer MR600 v5 web management interface. The flaw is reachable over an adjacent network (LAN or VPN) and requires an authenticated admin-level session; improper neutralization of user-controlled input lets the attacker inject shell commands when applying configuration changes. Successful exploitation gives the attacker full read and write access to the device and can crash or take over its operating environment. Patched-image rebuilds at versions EU_V5_1.7.0 0.9.1 260518 rel67803 and JP_V5_1.2.0 0.9.1 260519 rel52362 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network such as a LAN or VPN segment that can reach the device's web management interface; remote internet-based access alone is not sufficient.

• AuthenticationRequired

  An admin-level account is required; the attacker must authenticate with high-privilege credentials before injecting commands through the configuration interface.

• Victim interactionNot required

  No user interaction is needed; the attacker submits the malicious configuration directly through the web management API without involving any other user.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race condition, specific memory layout, or unusual environmental factor is required to trigger command execution.

Blast Radius

• Reads all data stored on or accessible by the device, including WireGuard private keys, VPN configuration secrets, and any credentials cached in the management interface.
• Modifies device configuration, routing rules, or firewall policies, enabling traffic interception or redirection for hosts behind the affected router.
• Executes arbitrary OS commands as a privileged process, giving the attacker persistent shell access to the device's underlying operating system.
• Crashes or reboots the affected device, disrupting network connectivity for all clients that depend on it for routing or VPN termination.