CVE-2026-9030: Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6
A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations.
By sending crafted systool instructions through the asynchronous request path, successful exploitation may cause the httpd process or device management service to crash and may result in temporary loss of access to the web management interface or device reboot.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9030?
CVE-2026-9030 has a risk level of 33, indicating a moderate severity for the authenticated denial-of-service vulnerability.
How do I fix CVE-2026-9030?
To address CVE-2026-9030, you should update your TP-Link Archer A6 v4 firmware to the latest version provided by TP-Link.
What impact does CVE-2026-9030 have on TP-Link Archer A6?
CVE-2026-9030 can lead to a denial-of-service condition when crafted systool instructions are sent to the HTTPD service.
Is CVE-2026-9030 exploitable remotely?
CVE-2026-9030 requires authentication, meaning that an attacker must have access credentials to exploit the vulnerability.
Which versions of TP-Link Archer A6 are affected by CVE-2026-9030?
CVE-2026-9030 specifically affects version 4 of the TP-Link Archer A6 HTTPD service.