CVE-2026-11834
2026-06-22
19h16 +00:00
19h16 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
A command
injection vulnerability has been identified in the DHCP option processing logic
in multiple TP-Link router models, due to insufficient validation of externally
supplied DHCP option data. An adjacent attacker may exploit this
vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized
command execution during device initialization or provisioning workflows. This
typically occurs when the device is in a factory-default or unconfigured state.
Successful
exploitation may allow an adjacent, unauthenticated attacker to execute
arbitrary commands with elevated privileges, potentially leading to full
compromise of the affected device and unauthorized administrative control.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Improper Neutralization of Special Elements used in an OS Command The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component. |
