CVE-2026-75616: Command Injection in Router Web Management Interface
An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise.
Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated to the router's web management interface as an administrator. The vulnerable operations are WAN-related configuration actions.
What could an attacker do after successful exploitation?
Successful exploitation can enable arbitrary system command execution with elevated privileges. This could result in full compromise of the device and affect the confidentiality, integrity, and availability of network traffic passing through it.