Medium severity · published Aug 7, 2026
CVE-2026-9031
Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web interface and a denial-of-service condition.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Archer A6 v4 · TP-Link Systems Inc.
before V4_1.15.10 Build 260625 Rel.25447 · source: vendor