A command injection vulnerability (CWE-78) exists in TP‑Link TL‑WR802N v4, TL‑WR841N v14, and TL‑WR840N v6 due to improper neutralization of special elements used in an OS command. The router configuration import function allows an authenticated attacker to upload a crafted configuration file that triggers the execution of arbitrary OS commands with root privileges during port‑trigger processing. Successful exploitation results in complete device compromise.

Affected vendors/products include TP Link Systems Inc. devices TL‑WR840N v6, TL‑WR802N v4, and TL‑WR841N v14. These versions are listed in the vendor’s supported firmware downloads and listed as vulnerable in the official advisory.

The CVSS score of 8.5 indicates high severity. EPSS scoring indicates the probability of exploitation is low (<1%), and the vulnerability is not currently listed in the CISA KEV catalog. Attack execution requires authenticated access to the router’s configuration import feature; the attacker must possess administrative privileges to upload the malicious configuration file. Upon successful submission, the injected commands run with root rights, providing full control over the device.