CVE-2026-3227: TP-Link Tl-WR802N Firmware

Medium severity, CVSS 6.8. EPSS: 1.9% chance of exploitation in the next 30 days.

A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.

Affected products

• TP-Link Tl-WR802N Firmware: before 260304 (fixed in 260304)
• TP-Link Tl-WR840N Firmware: before 260304 (fixed in 260304)
• TP-Link TL-WR841N Firmware: before 260303 (fixed in 260303)

Published 2026-03-16. Last modified 2026-07-01.