CVE-2026-9031

MediumCVSS 6.8

Published: 07/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 08/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before processing by internal flash-write logic. Successful exploitation may cause the httpd process or device to crash, resulting in loss of access to the web interface and a denial-of-service condition.

Risk Assessment

The risk includes disruption of web service and potential device crash, affecting the availability of device management.

Recommendation

Upgrade the device firmware to a patched version. Restrict access to the web interface to trusted networks only.

Other vulnerabilities in Archer A6 v4

CVE-2026-9030Medium
A denial-of-service vulnerability exists in the httpd service on Archer A6 v4 where the asynchronous systool instruction handling path does not properly synchronize or safely manage concurrent systool operations. Sending crafted systool instructions through the asynchronous request path may cause the httpd process or device management service to crash, resulting in temporary loss of access to the web management interface or device reboot.

Original NVD description (English source)

An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web interface and a denial-of-service condition.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS