CVE-2026-11409: OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N
An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If IPv6 PPPoE is not required, disable the IPv6 PPPoE configuration handler on the device to remove the vulnerable attack surface until a vendor patch/fix is available.
TP-Link TL-WR940N v6 IPv6 PPPoE = disabled - Compensating control
Restrict access to the device management interface to trusted IPs/networks only (via firewall, ACLs, management VLAN or jump host). Limit administrative access to internal networks and enforce strong authentication for admin accounts.
- Operational
Audit administrative accounts and logs for suspicious activity and rotate administrative credentials if compromise is suspected or as a precaution while the vulnerability remains unpatched.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11409?
The severity of CVE-2026-11409 is rated as high with a CVSS score of 8.5.
How do I fix CVE-2026-11409?
To fix CVE-2026-11409, update the firmware of your TP-Link TL-WR940N to the latest version that addresses this vulnerability.
What is the impact of CVE-2026-11409?
CVE-2026-11409 allows an authenticated attacker with administrative access to execute arbitrary commands on the system.
Is CVE-2026-11409 specific to certain devices?
Yes, CVE-2026-11409 specifically affects the TP-Link TL-WR940N router model.
When was CVE-2026-11409 published?
CVE-2026-11409 was published on June 16, 2026.