CVE-2026-15429 json
Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v
published 2026-07-14 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-43964
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data.
An authenticated user with sufficient privileges may be able to modify account settings and gain elevated administrative privileges.
Patch / fix
- TP-Link Systems Inc. Archer VX1800v v1 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 3 mo ago
Exploit prediction
1.39% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- TP-Link Systems Inc. Archer VX1800v v1
Classification
- Weakness
-
- CWE-93 Improper Neutralization of CRLF Sequences
References
-
tp-link.com
/en/support/download/archer-vx1800v/#Firmware
patch, product
-
tp-link.com
/us/support/faq/5189/
vendor-advisory
Sources
- CVE List CVE-2026-15429
- NVD CVE-2026-15429
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.