Vulnerability Intelligence Report
Command Injection Vulnerability in VPN connection of Archer BE800
CVE-2026-16348
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.
Injection
No Active Exploit Signals
CVSS Base Score
8.5
HIGH
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-78 ↗CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| TP-Link Systems Inc. | Archer BE800 v1 | 0 < 1.4.2 Build 260708 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Vulnerability Class
Injection
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | TP-Link Systems Inc. · Vendor · USA |
| Reserved | 2026-07-20T21:48:41 |
| Published | 2026-08-24T17:25:46 |
| Last Updated | 2026-08-25T03:56:53 |
Community Chatter & Buzz