CVE-2026-109683: UPnP Newline Injection Vulnerability in TP-Link Archer BE805

Published Nov 6, 2026

Updated

A newline injection vulnerability exists in the UPnP service of Archer BE805 v1 such that an adjacent attacker can supply newline characters in a UPnP port-mapping description due to improper sanitization, resulting in possible injection of unintended content into UPnP port-mapping data.

Successful exploitation may allow an unauthenticated attacker on the local network to modify runtime UPnP port-mapping information and create spoofed entries within the affected service. The issue is limited to the integrity of UPnP mapping data and does not demonstrate code execution or privilege escalation.

Frequently Asked Questions

Who is exposed to this issue?

Archer BE805 v1 devices with the UPnP service reachable by an attacker on the local network are exposed. The described attack is adjacent-network only; no remote Internet-based attack path is stated.

What does an attacker need to exploit it?

An unauthenticated attacker must be on the local network and able to submit a UPnP port-mapping description containing newline characters. No valid device credentials are described as necessary.

What is the impact if exploitation succeeds?

An attacker may alter runtime UPnP port-mapping information and create spoofed entries in the affected UPnP service. The available information limits impact to integrity of mapping data and does not indicate code execution or privilege escalation.

CVE-2026-109683: UPnP Newline Injection Vulnerability in TP-Link Archer BE805

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact if exploitation succeeds?