Loading vulnerability…
Authenticated Command Injection in TP-Link Archer BE450 v1 and BE7200 v1
CVE-2026-5509 is an authenticated command injection vulnerability affecting TP-Link Archer BE450 v1 and Archer BE7200 v1 routers. The flaw resides in the web management interface, where crafted input supplied by an authenticated administrator can be passed to backend system command execution without adequate sanitization. The described exploitation path involves using the browser developer console to submit malicious input through the administrative interface. Successful exploitation allows arbitrary system command execution with elevated privileges on the device, creating a path to full compromise of the router operating environment.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who has authenticated administrative access to the router can execute arbitrary system commands with elevated privileges. This can enable complete device compromise, including unauthorized service execution, modification of system configuration, and potential interception or manipulation of traffic traversing the router.
If you can’t patch tonight, do this now.
Restrict access to the web management interface to trusted administrative networks only, disable remote administration if it is not required, enforce strong unique administrator credentials, and monitor for unauthorized configuration changes or unexpected service activity. Because exploitation requires authenticated administrator access, reducing exposure of the management plane and tightly controlling privileged accounts lowers risk until patched firmware is deployed.
Patch, then assume compromise.
Upgrade affected TP-Link Archer BE450 v1 and Archer BE7200 v1 devices to the vendor-fixed firmware release. Versions below 1.3.0 Build 20260416 are identified as vulnerable, so administrators should install firmware version 1.3.0 Build 20260416 or later obtained from the official TP-Link regional support portal.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.