A command injection flaw exists in TP‑Link TL‑WR802N v4, TL‑WR841N v14, and TL‑WR840N v6 routers due to improper neutralization of special elements used in an OS command. An authenticated attacker who can log into the router’s administration interface can upload a crafted configuration file that is processed during port‑trigger processing, causing arbitrary OS commands to execute with root privileges. Successful exploitation permits full device compromise, allowing the attacker to control the router at the system level.

The affected products are TP‑Link TL‑WR840N firmware v6, TL‑WR802N firmware v4, and TL‑WR841N firmware v14. These models are specifically listed in the vendor’s advisory and correspond to the relevant firmware product identifiers.

The CVSS score of 8.5 indicates a high severity level. The EPSS score of less than 1% suggests that the likelihood of exploitation in the near term is low, and the vulnerability is not yet cataloged in the CISA KEV list. However, because the flaw requires only an authenticated session, any user or attacker who has gained administrative access could exploit the vulnerability. Full root‑level execution on the router vastly increases the potential damage and therefore represents a high‑risk condition that should prompt prompt remediation.