CVE-2026-38709 identifies a command injection vulnerability in the net.set_wan interface of several TR and WR series device versions. This vulnerability permits an attacker to execute arbitrary commands with root privileges by supplying specially crafted input to the affected interface. The vulnerability affects multiple specific versions of these devices, as listed in the description. No CVSS score or remediation level has been assigned, and no patch information is currently available. The vulnerability is publicly disclosed but not known to be exploited in the wild.

Successful exploitation of this vulnerability would allow an attacker to execute arbitrary commands as root on the affected devices. This could lead to full system compromise, unauthorized control, and potential disruption or manipulation of device functions. The impact is therefore high due to the root-level command execution capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the net.set_wan interface and monitor for suspicious activity related to this interface. Avoid exposing affected devices to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.