HIGH 7.3 NVD
CVE-2026-118865
An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage de
An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command.
Successful exploitation may allow arbitrary command execution on the affected device.
References
- https://www.tp-link.com/us/support/download/archer-ax3000/v2.60/#Firmware
- https://www.tp-link.com/us/support/faq/5380/
This high severity vulnerability with a CVSS score of 7.3 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18613 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.