Dashboard / CVE-2026-15428

CVE-2026-15428

HIGH
MEDIUM Priority: 0.18 BB Relevance: 47/100
Published: 2026-07-14 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: High
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges. Successful exploitation may allow remote code execution and complete compromise of the device.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
tp-link archer_vx1800v_firmware < 0.16.0
tp-link archer_vx1800v_firmware 2.0.0

References & Advisories (2)

Bug Bounty Relevance

47 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

8.5 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

2.08%
Raw Score 0.020830
Percentile 81.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.02083
2026-10-28
0.02083

Intelligence Sources

nvd ref →

External Links