---
id: CVE-2026-75616
title: >-
  An OS command injection vulnerability exists in the web management interface
  of Archer C20 v6 firmware when processing certain WAN-related configuration
  operations
summary: >-
  An OS command injection vulnerability exists in the web management interface
  of Archer C20 v6 firmware when processing certain WAN-related configuration
  operations. An authenticated administrator may exploit insufficient input
  validation…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: tp-link
product: archer_c20_firmware
affected:
  - archer_c20_firmware < 0.9.1
patched:
  - archer_c20_firmware 0.9.1
published: '2026-08-19'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:12:13.843'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75616'
references:
  - url: 'https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/en/support/faq/5252/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/download/archer-c20/v6.46/#Firmware'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
  - exploit-available
epss: 0.02827
epssPercentile: 0.86012
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/totekuh/CVE-2026-75616'
  checkedAt: '2026-09-25T08:21:12.670Z'
exploitAvailable: true
ingestedAt: '2026-09-08T22:12:30.940Z'
---

## Overview

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise.






Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it.

## Affected

- `archer_c20_firmware < 0.9.1`

## Remediation

Upgrade past the affected range:

- `archer_c20_firmware 0.9.1`