CVE-2026-109683
Last modified
CVE-2026-109683 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A newline injection vulnerability exists in the UPnP service of Archer BE805 v1 such that an adjacent attacker can supply newline characters in a UPnP port-mapping description due to improper sanitization, resulting in possible injection of unintended content into UPnP port-mapping data. Successful exploitation may allow an unauthenticated attacker on the local network to modify runtime UPnP port-mapping information and create spoofed entries within the affected service. The issue is limited to the integrity of UPnP mapping data and does not demonstrate code execution or privilege escalation..
Description
A newline injection vulnerability exists in the UPnP service of Archer BE805 v1 such that an adjacent attacker can supply newline characters in a UPnP port-mapping description due to improper sanitization, resulting in possible injection of unintended content into UPnP port-mapping data. Successful exploitation may allow an unauthenticated attacker on the local network to modify runtime UPnP port-mapping information and create spoofed entries within the affected service. The issue is limited to the integrity of UPnP mapping data and does not demonstrate code execution or privilege escalation.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | Archer BE805 v1 | < V1.6_1.5.1 Build 261102; < V1.20_1.5.1 Build 261102 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-109683?
How severe is CVE-2026-109683?
How do I fix CVE-2026-109683?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-109678FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose W…6.5
- CVE-2026-109679FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer de…5.3
- CVE-2026-10968Insufficient validation of untrusted input in Dawn in Google…7.4
- CVE-2026-109680FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds …6.5
- CVE-2026-109681The FTP client trusts the server's PASV response IP:port wit…4.7
- CVE-2026-109682Metasploit Framework versions before 6.5.7 allow HTTP reques…4.7
- CVE-2026-109684Missing Authorization vulnerability in TMS Amelia ameliabook…5.3
- CVE-2026-109685Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2026-109686Deserialization of Untrusted Data vulnerability in Link Whis…9.8
- CVE-2026-109687Improper Neutralization of Special Elements used in an SQL C…7.6
- CVE-2026-109688Improper Neutralization of Special Elements used in an SQL C…9.3
- CVE-2026-109689Missing Authorization vulnerability in WP Sunshine Sunshine …5.3
Are you affected by CVE-2026-109683?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST