Is CVE-2026-3227 actively exploited?

No active exploitation of CVE-2026-3227 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-3227 be exploited remotely?

Partially. CVE-2026-3227 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-3227?

CVE-2026-3227 has a CVSS score of 8.5 (HIGH).

HOME VULNERABILITIESCVE-2026-3227

HIGH

CVE-2026-3227

CWE-78Published: March 16, 2026· Updated: Mar 16, 2026

8.5

CVSS v3.1

EPSS:0.42%probability of exploitation in 30 daysPercentile:61.5th

Official Description

A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing.

Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.

NVD Source

Technical Analysis

CVE-2026-3227 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorAdjacent

Attack ComplexityLow

Privileges Req.High

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X