Read the docs
TI-2026-04826 Aliases CVE-2026-5509GHSA-5qh8-v6gw-rfcc

Arbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE7200

Priority MEDIUM 44CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system commands through the web management interface. After successfully authenticating to the admin interface, an attacker can leverage the browser’s developer console by supplying a crafted input that is passed to backend system commands without adequate sanitization. Successful exploitation enables execution of arbitrary commands with elevated privileges on the device, which may allow the attacker to start unauthorized services, modify system configuration, or otherwise fully compromise the router’s operating environment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02458 84th percentileScored 2026-11-07
Fix Fixed Archer BE7200 V1 (TP-Link Systems Inc.): 1.3.0 Build 20260416Archer BE450 v1 (TP-Link Systems Inc.): 1.3.0 Build 20260416

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkArcher BE7200 V1before 1.3.0 Build 202604161.3.0 Build 20260416Patch availableCNA
TP-LinkArcher BE450 v1before 1.3.0 Build 202604161.3.0 Build 20260416Patch availableCNA
  • Archer BE7200 V1 VendorTP-Link Affected before 1.3.0 Build 20260416 Fixed in 1.3.0 Build 20260416 Patch available CNA
  • Archer BE450 v1 VendorTP-Link Affected before 1.3.0 Build 20260416 Fixed in 1.3.0 Build 20260416 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:archer_be450_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_be450:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
cpe:2.3:o:tp-link:archer_be7200_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_be7200:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
  • cpe:2.3:o:tp-link:archer_be450_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_be450:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:archer_be7200_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_be7200:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link

Remediation

  • Fix · CNA Archer BE7200 V1 (TP-Link Systems Inc.) Fixed in 1.3.0 Build 20260416
  • Fix · CNA Archer BE450 v1 (TP-Link Systems Inc.) Fixed in 1.3.0 Build 20260416

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5509
  2. 2026-10-03 Alias added: GHSA-5qh8-v6gw-rfcc
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 4

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences