Cyber Resilience

CVE-2026-3227

High

Published: 16 March 2026

Published
16 March 2026
Modified
07 April 2026
KEV Added
—
Patch
—
CVSS Score v4 8.5 CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0110 61.5th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-3227 is a high-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Tl-Wr802N Firmware. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 38.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a…

more

crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

CWE-78 OS command injection in config import directly enables Unix shell command execution with root privileges on the device.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-22229Same vendor: Tp-Link
CVE-2026-22223Same vendor: Tp-Link
CVE-2025-9377Same product: Tp-Link Tl-Wr841N
CVE-2026-22227Same vendor: Tp-Link
CVE-2026-30818Same vendor: Tp-Link
CVE-2026-0630Same vendor: Tp-Link
CVE-2026-22225Same vendor: Tp-Link
CVE-2026-0654Same vendor: Tp-Link
CVE-2026-30815Same vendor: Tp-Link
CVE-2026-0631Same vendor: Tp-Link

Affected Assets

tp-link
tl-wr802n firmware
≤ 260304
tp-link
tl-wr841n firmware
≤ 260303
tp-link
tl-wr840n firmware
≤ 260304

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References