Authenticated command injection in TP-Link Archer MR600 v5 admin interface

Successful exploitation allows authenticated command execution on the router, with high impact to confidentiality, integrity, and availability. Depending on the commands executed, this can lead to denial of service, full takeover of the device (effectively root-level control from an authenticated admin session), and potential follow-on impacts such as broader network control/lateral movement from the compromised edge device.

Until patching is completed, reduce exposure of the management plane: disable/avoid remote administration from untrusted networks/Internet, restrict admin interface access to trusted hosts/users (e.g., dedicated management network/VPN), and enforce strong unique admin credentials to reduce the chance of credential guessing/default credential abuse. Increase monitoring for suspicious administrative activity and anomalous command execution patterns on/against the router management interface, and be prepared to respond quickly (including device reset) if exploitation is suspected.

Upgrade TP-Link Archer MR600 v5 to a vendor-fixed firmware release. The advisory indicates affected versions include 0.9.1 and below and firmware versions earlier than v0001.0 Build 250930 Rel.63611n; upgrade to Build 250930 Rel.63611n (or later) from TP-Link’s official support portal after appropriate testing/validation. If compromise is suspected, note that patching prevents future exploitation but does not remediate prior compromise; investigate and factory-reset/reimage as appropriate.