High-Severity Command Injection Flaw Disclosed in TP-Link Routers
A critical authenticated command injection vulnerability, tracked as CVE-2026-5509 (CVSS v4.0: 8.5), has been identified in two TP-Link router models the Archer BE450 v1 and Archer BE7200 v1. The flaw allows attackers to execute arbitrary OS commands via the web management interface after gaining admin access, due to insufficient input sanitization in the backend.
Exploitation requires network adjacency and high privileges but involves low complexity and no user interaction. Successful attacks could grant full device control, enabling threat actors to intercept network traffic, modify system configurations, or deploy unauthorized services posing significant risks to data privacy.
The vulnerability mirrors past TP-Link router flaws, including CVE-2025-14756 (Archer MR600) and CVE-2023-1389 (Archer AX21), highlighting a recurring pattern of command injection risks in the Archer product line.
Affected Models & Remediation
The flaw impacts Archer BE450 v1 and BE7200 v1 running firmware versions earlier than 1.3.0 Build 20260416. TP-Link has released a patch, and users are advised to upgrade immediately. Notably, these models are not sold in the U.S., with distribution primarily in markets like Japan.
While patching is the primary mitigation, administrators should also enforce strong credentials, restrict web management access, and disable remote management unless necessary. Given TP-Link’s history of similar vulnerabilities, regular firmware audits are recommended for ongoing security.
Source: https://cyberpress.org/tp-link-router-vulnerability/
TP-Link Systems Inc. cybersecurity rating report: https://www.rankiteo.com/company/tp-link
"id": "TP-1780381426",
"linkid": "tp-link",
"type": "Vulnerability",
"date": "4/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Networking Hardware',
'location': 'Global (primarily Japan, not sold in the '
'U.S.)',
'name': 'TP-Link',
'type': 'Technology Company'}],
'attack_vector': 'Web Management Interface',
'customer_advisories': 'Users advised to upgrade firmware immediately and '
'follow mitigation steps.',
'data_breach': {'sensitivity_of_data': 'High (potential data privacy risks)',
'type_of_data_compromised': 'Network traffic, system '
'configurations'},
'description': 'A critical authenticated command injection vulnerability, '
'tracked as CVE-2026-5509 (CVSS v4.0: 8.5), has been '
'identified in two TP-Link router models: the Archer BE450 v1 '
'and Archer BE7200 v1. The flaw allows attackers to execute '
'arbitrary OS commands via the web management interface after '
'gaining admin access, due to insufficient input sanitization '
'in the backend. Exploitation requires network adjacency and '
'high privileges but involves low complexity and no user '
'interaction. Successful attacks could grant full device '
'control, enabling threat actors to intercept network traffic, '
'modify system configurations, or deploy unauthorized '
'services, posing significant risks to data privacy.',
'impact': {'data_compromised': 'Network traffic interception, system '
'configurations, unauthorized services '
'deployment',
'operational_impact': 'Full device control, potential data privacy '
'risks',
'systems_affected': 'Archer BE450 v1, Archer BE7200 v1'},
'lessons_learned': 'Recurring pattern of command injection risks in TP-Link '
'Archer product line; regular firmware audits recommended '
'for ongoing security.',
'post_incident_analysis': {'corrective_actions': 'Patch released, improved '
'input validation, regular '
'security audits',
'root_causes': 'Insufficient input sanitization in '
'the backend of the web management '
'interface'},
'recommendations': 'Upgrade firmware immediately, enforce strong credentials, '
'restrict web management access, disable remote management '
'unless necessary, conduct regular firmware audits.',
'references': [{'source': 'CVE Details'},
{'source': 'TP-Link Security Advisory'}],
'response': {'containment_measures': 'Patch released, enforce strong '
'credentials, restrict web management '
'access, disable remote management '
'unless necessary',
'remediation_measures': 'Upgrade firmware to version 1.3.0 Build '
'20260416 or later'},
'title': 'High-Severity Command Injection Flaw Disclosed in TP-Link Routers',
'type': 'Command Injection',
'vulnerability_exploited': 'CVE-2026-5509'}