CVE-2026-38713

CriticalCVSS 9.8

Published: 31/07/2026(UTC)Updated: 03/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.21%

65th percentile - higher than 65% of all known CVEs

Summary

Routers TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 with specific firmware versions contain a command injection vulnerability in the ipsec_conn interface. Attackers can execute arbitrary commands as root via crafted input.

Risk Assessment

Attackers can gain full control over the device, leading to network compromise and data theft.

Recommendation

Update the router firmware to the latest available version that fixes this vulnerability.

Original NVD description (English source)

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the ipsec_conn interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.