Medium severity · published Aug 7, 2026
CVE-2026-9031
Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
An input validation
vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation
of user-supplied data before it is processed by internal flash-write handling
logic.
Successful
exploitation may cause httpd process or device to crash, resulting in loss of access
to the web interface and a denial-of-service condition.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Archer A6 v4 · TP-Link Systems Inc.
before V4_1.15.10 Build 260625 Rel.25447 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9031
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9031
www.tp-link.com
https://www.tp-link.com/en/support/download/archer-a6/v4/#Firmware
www.tp-link.com
https://www.tp-link.com/en/support/faq/5234/
www.tp-link.com
https://www.tp-link.com/us/support/download/archer-a6/v4/#Firmware
More from Archer A6 v4
6.8
CVE-2026-9030
Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6
