injection vulnerability exists in the UPnP service of Archer BE805 v1 such that
an adjacent attacker can supply newline characters in a UPnP port-mapping
description due to improper sanitization, resulting in possible injection of unintended
content into UPnP port-mapping data.
Successful
exploitation may allow an unauthenticated attacker on the local network to
modify runtime UPnP port-mapping information and create spoofed entries within
the affected service. The issue is limited to the integrity of UPnP mapping
data and does not demonstrate code execution or privilege escalation.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Archer BE805 v1 | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Tp-link
Subscribe
|
Archer Be805 V1
Subscribe
|
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 09 Nov 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Tp-link
Tp-link archer Be805 V1 |
|
| Vendors & Products |
Tp-link
Tp-link archer Be805 V1 |
Fri, 06 Nov 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A newline injection vulnerability exists in the UPnP service of Archer BE805 v1 such that an adjacent attacker can supply newline characters in a UPnP port-mapping description due to improper sanitization, resulting in possible injection of unintended content into UPnP port-mapping data. Successful exploitation may allow an unauthenticated attacker on the local network to modify runtime UPnP port-mapping information and create spoofed entries within the affected service. The issue is limited to the integrity of UPnP mapping data and does not demonstrate code execution or privilege escalation. | |
| Title | UPnP Newline Injection Vulnerability in TP-Link Archer BE805 | |
| Weaknesses | CWE-93 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: TPLink
Published:
Updated: 2026-11-06T19:26:40.010Z
Reserved: 2026-10-12T23:44:19.158Z
Link: CVE-2026-109683
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-06T20:17:09.863
Modified: 2026-11-06T21:15:29.947
Link: CVE-2026-109683
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-09T17:13:03Z