CVE-2026-38711 affects specific versions of TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 devices. The vulnerability is a command injection in the system.upgrade_check interface, enabling unauthenticated attackers to execute arbitrary commands as root. The CVSS v3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a network attack vector with no privileges or user interaction required and full system compromise potential. No patch or official remediation level is currently documented, and no exploits are known to be active in the wild.

Successful exploitation allows remote attackers to execute arbitrary commands with root privileges on affected devices, leading to full compromise of confidentiality, integrity, and availability. This can result in complete control over the device and potentially the network it resides on.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the system.upgrade_check interface and monitor for suspicious activity related to this interface. Avoid exposing affected devices directly to untrusted networks.