This vulnerability (CVE-2026-15427) affects the TP-Link Archer VX1800v v1 router's TR-069 / CWMP management interface. Due to improper neutralization of special elements in input parameters (CWE-78), an attacker who can influence the ACS-delivered commands can inject OS commands. The vulnerability requires TR-069 to be enabled and attacker control or compromise of the ACS server. Exploitation leads to arbitrary command execution with root privileges on the device, allowing complete compromise. The CVSS 4.0 base score is 8.6, indicating high severity. No patch or official remediation is currently documented, and no known exploits are reported in the wild.

If exploited, this vulnerability allows an attacker to execute arbitrary system-level commands with root privileges on the affected device. This results in complete compromise of the device, potentially allowing full control over its functions and data. The attack requires specific conditions, including TR-069 being enabled and control over the ACS server, limiting the attack surface but increasing impact if those conditions are met.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider disabling TR-069 / CWMP management interface if not required, and ensure the ACS server is secured and trusted to prevent unauthorized command injection. Monitor vendor communications for updates on patches or official mitigations.