CVE-2026-11410: OS Command Injection in BigPond Cable (BPA) Configuration in TP-Link TL-WR940N
An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict administrative access to the TL-WR940N device to trusted hosts only. Disable remote/ WAN-side management if enabled and apply firewall/ACL rules to permit management only from specific IP addresses or networks.
- Compensating control
Isolate the device from untrusted networks where feasible (for example, place it behind additional network segmentation or a management VLAN) to reduce the attack surface available to unauthenticated or low-privilege actors.
- Operational
Rotate administrative credentials immediately (change administrator passwords) and remove or disable any unnecessary administrative accounts. Ensure remaining admin credentials follow strong password policies and multi-factor authentication where supported.
- Operational
Audit device logs and configuration for signs of unauthorized changes or command execution. If compromise is suspected, perform recovery actions such as restoring a known-good configuration or factory reset and reapplying secure configuration; then re-audit.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11410?
CVE-2026-11410 has a high severity rating of 8.5.
How do I fix CVE-2026-11410?
To fix CVE-2026-11410, update the TP-Link TL-WR940N firmware to the latest version provided by the manufacturer.
What type of vulnerability is CVE-2026-11410?
CVE-2026-11410 is an OS Command Injection vulnerability.
Who can exploit CVE-2026-11410?
An attacker with administrative access can exploit CVE-2026-11410.
What are the potential consequences of CVE-2026-11410?
The potential consequences of CVE-2026-11410 include arbitrary command execution with elevated privileges.