Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component
Archer AX3000 v2 devices with a USB storage device attached to the Offline Download component are affected. The fix is in 1.1.3 Build 261026.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 1.1.3 Build 261026
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Archer AX3000 v2 with a USB storage device attached to the Offline Download component
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity7.3/10CVSS 7.3
- No patch0/5No signal
What would change the score
- Would score about 62 if added to CISA KEV
- Would score about 57 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
CVE-2026-118865 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.3 (high) and affects Archer AX3000 v2; fixed in 1.1.3 Build 261026.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 12/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.1.3 Build 261026
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Archer AX3000 v2 router's Offline Download feature, which handles USB storage devices, is affected. An authenticated administrator could exploit it to run arbitrary commands on the device.
Read the original description
An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command. Successful exploitation may allow arbitrary command execution on the affected device.
What to do
Check whether your setup matches what the bug needs.
Archer AX3000 v2 with a USB storage device attached to the Offline Download componentUpgrade to a fixed version: 1.1.3 Build 261026.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- TP-Link Systems Inc. Archer AX3000 v2
fixed in 1.1.3 Build 261026
Evidence 2
- Advisory
- Patch
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-118865
Is CVE-2026-118865 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
When a USB storage device is attached, an authenticated administrator can submit a crafted path value to the Offline Download component. Successful use of this path may allow arbitrary command execution on the device.Source: tp-link.com
Which versions are affected by CVE-2026-118865?
Archer AX3000 v2: before 1.1.3 Build 261026.Source: cve.now feed data
Am I affected, and how do I check?
The affected product is the Archer AX3000 v2, with firmware versions before 1.1.3 Build 261026. The condition is a USB storage device attached to the Offline Download component. To check, look up the firmware version in the router's admin interface and see whether a USB storage device is connected.Source: tp-link.com
How do I fix CVE-2026-118865?
Update the Archer AX3000 v2 to firmware 1.1.3 Build 261026 or later.Source: tp-link.com