TP-Link Archer Routers Patched for Command Injection and Multiple Security Flaws
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen May 25, 2026
TP-Link has disclosed and patched a high-severity authenticated command injection flaw, CVE-2026-5509, affecting Archer BE450 v1 and BE7200 v1 routers. The vulnerability in the web management interface carries a CVSS 8.5 score and can let an attacker who has already gained administrative access execute arbitrary system commands, potentially leading to elevated privileges, configuration tampering, unauthorized service execution, and interception of sensitive network traffic. TP-Link said devices running firmware earlier than 1.3.0 Build 20260416 are vulnerable and urged customers to install the latest firmware from its regional support portals.
The disclosure follows broader reporting on security weaknesses affecting TP-Link Archer NX routers, adding to concerns over exploitable flaws in the vendor’s consumer networking lineup. Together, the reports highlight continued risk in internet-facing router management functions, where compromised credentials or prior access can turn web interface bugs into full device compromise. Organizations and home users using affected Archer models should verify firmware versions, restrict administrative access, and apply vendor updates immediately.
