TP-Link Router Security Bug Enables Remote Command Execution Attacks

TP-Link has disclosed a high-severity security flaw in its Archer BE450 and Archer BE7200 Wi‑Fi routers that could allow remote command execution once an attacker gains admin access.

The vulnerability, tracked as CVE-2026-5509, is rated 8.5 (High) under CVSS v4.0, highlighting the serious risk it poses to both home and small-office networks that rely on these devices as core gateways.

TP-Link Router Security Flaw

According to TP-Link’s security advisory, the issue is an authenticated command injection vulnerability in the web management interface of the Archer BE450 v1 and BE7200 v1 routers.

The flaw affects firmware versions below 1.3.0 Build 20260416 on both models, meaning any device that has not yet installed this firmware baseline remains exposed to potential exploitation. Importantly, TP-Link notes that these models are not sold in the United States. However, they are available in other markets and may still be deployed in sensitive environments.

The attack path begins after the threat actor successfully logs into the router’s admin interface with valid credentials. Once authenticated, the attacker can abuse the browser’s developer console to craft and send specially formatted input that the backend processes do not properly sanitize.

Because the application passes this input directly to system-level command execution without adequate filtering, the router executes arbitrary commands with elevated privileges, effectively handing over control of the embedded operating system.

With this level of access, an attacker could start unauthorized services, tamper with routing and DNS settings, deploy additional malware, or use the router as a pivot point for deeper attacks inside the local network.

Compromised routers can also be integrated into botnets, used for man-in-the-middle interception, or configured to redirect persistent traffic to attacker-controlled infrastructure.

While the vulnerability requires high privileges (PR:H), the risk is amplified when administrators reuse passwords, rely on weak credentials, or expose management interfaces to less-trusted network segments.

TP-Link has released patched firmware for both affected models and urges users to upgrade to version 1.3.0 Build 20260416 or later as soon as possible. Firmware images for the Archer BE450 and Archer BE7200 can be downloaded from TP-Link’s regional support portals, including English and Japanese pages.

The vendor also recommends limiting access to the web management interface, disabling remote administration when not strictly required, and enforcing strong, unique administrator passwords to reduce the likelihood of credential compromise.

CVE-2026-5509 adds to a growing list of command injection flaws affecting router web interfaces. It once again underlines the importance of secure input handling in embedded web management code. For defenders, prompt patching, strict access control, and continuous monitoring of router behavior remain critical to preventing network-wide impact from gateway-level compromises.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.