CVE-2021-44827: TP-Link Archer C20i authenticated OS command injection via IPv6 parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and public exploit references, tempered by the requirement for authenticated access.

What it is

TP-Link Archer C20i firmware 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n fails to sanitize the X_TP_ExternalIPv6Address HTTP parameter, allowing OS command injection. An attacker who can authenticate to the router's web interface can execute arbitrary commands as root, giving full control of the device.

Impact

An authenticated attacker gains root-level command execution on the router, enabling full device compromise, persistent configuration changes, traffic interception or use of the router as a foothold into the network.

Attack surface

Reachable over the network through the router's HTTP management interface; the CVSS vector (AV:N/PR:L/UI:N) indicates network access with low privileges required and no user interaction.

Exploitation

Not listed in CISA KEV, but public exploit references are tagged Exploit and EPSS is 0.53956 (99th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor firmware update from TP-Link's security page for Archer C20i; if no fix exists for this build, replace or retire the device.
• Restrict management interface access to trusted internal networks and disable remote/WAN administration.
• Change default and weak admin credentials and enforce strong unique passwords for the router UI.
• Segment IoT and router management traffic from production networks to limit lateral movement after compromise.
• Monitor TP-Link security advisories for updated firmware or end-of-support notices for this model.

Detection

• Inspect HTTP requests to the router management interface for the X_TP_ExternalIPv6Address parameter containing shell metacharacters or command strings.
• Monitor router logs and outbound traffic for unexpected processes, connections or DNS queries originating from the device.
• Alert on configuration changes or new admin accounts on the router outside of approved maintenance windows.
• Baseline normal management-plane request patterns and flag anomalous POSTs to configuration endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.