Authenticated OS Command Injection in TP-Link Archer C20 Routers

CVE-2026-75616 is a critical vulnerability affecting the TP-Link Archer C20 v6 router series, specifically within the handling of BPA WAN configuration settings in the web management interface. An attacker who has already obtained administrator credentials for the device can leverage this flaw to perform OS command injection. By injecting malicious shell commands into the BPA WAN parameters, the attacker can force the system to execute code with root privileges. A proof-of-concept exploit has been published, utilizing Python to interact with the device's web management interface, demonstrating how an attacker can establish a reverse shell connection to the router. This vulnerability impacts EU, US, and RU firmware versions earlier than build 260811/260812.

Impact

Successful exploitation of this vulnerability grants an attacker full root-level control over the Archer C20 v6 router. Given the position of the router at the edge of the network, this allows for persistent unauthorized access, traffic interception, and potential lateral movement into the local network. Users are strongly advised to update to the latest manufacturer-provided firmware to mitigate this risk.

Recommendation

• Immediately update TP-Link Archer C20 v6 firmware to the latest available version (at least Build 260811 for EU, or 260812 for US/RU) to patch CVE-2026-75616.
• Restrict access to the router web management interface to trusted internal IP addresses only.
• Rotate administrator credentials for all TP-Link router interfaces immediately, as the vulnerability requires administrative access for exploitation.
• Audit network logs for unusual outbound connections originating from the router's management IP, specifically focusing on connections to unauthorized remote listener ports (e.g., port 4445 as documented in the PoC).