A command injection vulnerability was identified in TP-Link TL-WR802N v4

CVE-2026-3227 is a classic CWE-78 OS command injection in the web management interface of three low-end TP-Link SOHO wireless routers: TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6. A parameter reaching the underlying system()/popen() chain is not neutralized, so an authenticated administrator can chain shell metacharacters and pop a root shell on the device's BusyBox userland. The attacker has to be on the LAN/Wi-Fi (AV:A) and already hold admin credentials (PR:H).

The vendor's MEDIUM (6.8) rating is honest — arguably even generous. The CVSS vector reflects the real gating factors: adjacent-network reach and high-privilege prerequisite. In an enterprise fleet context this is even softer, because these SKUs are consumer travel/home routers that should not be sitting on a managed corporate segment at all. The interesting question isn't the bug, it's *why is this device on your network?*

Why this verdict

• Two stacked prerequisites (PR:H + AV:A): attacker must both reach the LAN and already own admin — this implies post-initial-access AND post-credential-compromise, two independent gates.
• No KEV, no PoC, EPSS 0.011: every exploitation signal is cold; there's no urgency injected by the threat-intel side.
• Role multiplier — low-value role only: these SKUs are consumer travel/home routers. Even if the chain succeeds, blast radius is confined to the single device and the segment behind it — not identity, not a hypervisor, not a CA. There is no plausible high-value-role deployment (nobody terminates enterprise VPN or peers BGP on a TL-WR802N), so the deployment-role floor does not lift the verdict.
• Installed-base share in enterprise <<1%: managed enterprises standardize on Meraki/Aruba/Fortinet/Cisco/Ubiquiti at the edge. TP-Link SOHO SKUs appearing in a corporate fleet are shadow-IT rogues, not baseline hardware.

Why not higher?

MEDIUM would require either broader exposure (WAN-side admin, which is off by default) or a lower privilege bar. HIGH would require a role multiplier — but the affected SKUs are canonically low-value consumer devices with no plausible identity/hypervisor/CI-CD/edge-enterprise role. There is no signal (KEV, PoC, campaign) to override the friction analysis.

Why not lower?

It is not IGNORE because a real, unauthenticated attacker adjacent to the device (open Wi-Fi, guest network, physical LAN port) who obtains credentials via any means gets root on a network-path device — that is still a meaningful pivot for MITM/DNS-hijack on whoever sits behind it. It stays as tracked backlog rather than being written off.

1. Inventory and remove shadow-IT TP-Link SOHO routers from managed segments — Run a NAC/DHCP sweep for TP-Link OUIs (C0:C9:E3, 98:DA:C4, 50:C7:BF, EC:08:6B, etc.) on corporate VLANs and quarantine unmanaged devices. No mitigation SLA at LOW severity — fold into the next quarterly asset-hygiene sprint.
2. Enforce 802.1X on wired ports and WPA3-Enterprise on Wi-Fi — Denies rogue routers the L2 presence they need for step 1 of the attack path. This is a general control worth having regardless of this CVE.
3. Change all TP-Link admin passwords and disable WAN-side admin — For any device you legitimately keep, rotate admin creds to a password-manager-generated value and confirm remote management is off. Kills the credential-recovery path in step 2.
4. Update firmware to the TP-Link fixed build during next maintenance window — For devices you actually own on purpose, flash the vendor-provided fix. No urgency, but do it inside the noisgate remediation SLA (365 days).

Run this from an auditor workstation on the same LAN segment as the router (not from the router itself). Requires curl and network reachability to the router's LAN IP. Invoke as: ./check-cve-2026-3227.sh 192.168.0.1. No credentials needed — this only reads the model/firmware banner from the login page.

#!/usr/bin/env bash
# noisgate check for CVE-2026-3227 (TP-Link SOHO command injection)
# Usage: ./check-cve-2026-3227.sh <router-lan-ip>
# Exit codes: 0 = PATCHED / not applicable, 1 = VULNERABLE, 2 = UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN: usage: $0 <router-lan-ip>" >&2
  exit 2
fi

# Grab the login page — TP-Link routers advertise model + firmware in the HTML
HTML=$(curl -sS --max-time 5 "http://${TARGET}/" 2>/dev/null || true)
if [[ -z "$HTML" ]]; then
  echo "UNKNOWN: no HTTP response from ${TARGET}"
  exit 2
fi

# Model detection
MODEL=""
if   grep -qiE 'TL-WR802N.*v?4'  <<<"$HTML"; then MODEL="TL-WR802N v4"
elif grep -qiE 'TL-WR841N.*v?14' <<<"$HTML"; then MODEL="TL-WR841N v14"
elif grep -qiE 'TL-WR840N.*v?6'  <<<"$HTML"; then MODEL="TL-WR840N v6"
fi

if [[ -z "$MODEL" ]]; then
  echo "PATCHED: target is not an affected TP-Link SKU (or fingerprint failed)"
  exit 0
fi

# Firmware build detection — TP-Link exposes "Firmware Version: X.Y.Z Build YYYYMMDD"
FW=$(grep -oiE 'Firmware Version[^<]*' <<<"$HTML" | head -n1 || true)
BUILD=$(grep -oiE 'Build[[:space:]]*[0-9]{8}' <<<"$FW" | grep -oE '[0-9]{8}' | head -n1 || true)

if [[ -z "$BUILD" ]]; then
  echo "UNKNOWN: ${MODEL} detected but firmware build not readable — log in and check manually"
  exit 2
fi

# Fix landed in TP-Link's March 2026 advisory cycle; treat builds < 20260316 as vulnerable
if (( BUILD < 20260316 )); then
  echo "VULNERABLE: ${MODEL} firmware build ${BUILD} — CVE-2026-3227 applies"
  exit 1
else
  echo "PATCHED: ${MODEL} firmware build ${BUILD}"
  exit 0
fi

Sources

1. NVD — CVE-2026-3227
2. MITRE CVE record
3. TP-Link Security Advisories
4. CWE-78: OS Command Injection
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS
7. TP-Link TL-WR841N product page
8. TP-Link TL-WR802N product page