## https://sploitus.com/exploit?id=8FE02773-848D-5AFE-9942-9C0B004CD15B
# CVE-2026-75616
Authenticated OS command injection in the TP-Link Archer C20 v6 web management interface.
BPA WAN configuration values are passed to `system()` without adequate neutralization, allowing an authenticated administrator on the adjacent network to execute commands as root.
Discovered and reported by Daniil Gordeev ([totekuh](https://github.com/totekuh)).
## Affected Versions
- Archer C20 v6 EU firmware earlier than `0.9.1 Build 260811`
- Archer C20 v6 US firmware earlier than `0.9.1 Build 260812`
- Archer C20 v6 RU firmware earlier than `0.9.1 Build 260812`
## Requirements
- Administrator credentials
- Access to the router's LAN web interface
- WAN connected to a network that provides DHCP
- Python 3, `requests`, and `pycryptodome`
## Usage
```bash
python3 -m pip install requests pycryptodome
python3 bpa-poc.py --target 192.168.0.1 --password ''
nc 192.168.0.1 4445
```
Use `--list-only` to enumerate WAN instances without triggering the command
injection.
## References
- [TP-Link advisory](https://www.tp-link.com/en/support/faq/5252/)
- [CVE record](https://vulners.com/cve/CVE-2026-75616)
- [NVD record](https://nvd.nist.gov/vuln/detail/CVE-2026-75616)