TP-Link Router Vulnerability Allows Attackers to Execute Arbitrary System Commands

HomeCyber Security News TP-Link Router Vulnerability Allows Attackers to Execute Arbitrary System Commands By Abinaya June 2, 2026 A newly disclosed high-severity vulnerability in TP-Link routers could allow attackers to execute arbitrary system commands and fully compromise affected devices. Tracked as CVE-2026-5509, the flaw affects Archer BE450 v1 and Archer BE7200 v1 models. It has been assigned a CVSS v4.0 score of 8.5, indicating a high risk to users and enterprise environments that rely on these devices. According to TP-Link’s security advisory published on May 27, 2026, the vulnerability is a command injection flaw in the router’s web management interface that requires authentication. The issue arises due to insufficient input sanitization in backend system commands. Once an attacker successfully logs into the administrative interface, they can exploit the flaw using the browser’s developer console by injecting specially crafted input that is improperly processed by the system. TP-Link Router Vulnerability This attack method requires no user interaction beyond authentication, making it particularly dangerous in scenarios where administrative credentials are weak, reused, or previously exposed. After exploitation, attackers can execute arbitrary commands with elevated privileges on the router’s underlying operating system. This level of access enables threat actors to manipulate system configurations, deploy unauthorized services, or maintain persistent access within the network. In a practical attack scenario, a malicious insider or an external attacker with stolen credentials could access the router’s admin panel and use the browser console to inject command payloads. For example, an attacker could execute system-level commands to enable remote access services, alter firewall rules, or redirect traffic for surveillance and data interception purposes. Such actions can significantly impact network integrity, confidentiality, and availability. The vulnerability affects Archer BE450 v1 and Archer BE7200 v1 devices running firmware versions earlier than 1.3.0 Build 20260416. TP-Link has released patched firmware to address the issue and strongly advises users to upgrade immediately. Devices that remain unpatched are at continued risk of compromise, especially in environments where routers are directly exposed or poorly secured. Security experts emphasize that this vulnerability underscores the ongoing risks posed by web-based management interfaces, particularly when input validation mechanisms are not properly enforced. Attackers increasingly target network edge devices, such as routers, to gain a foothold in internal networks, making timely patching and secure configuration critical. TP-Link has clarified that the affected models are not sold in the United States. However, users in other regions, including Asia and Europe, may still be exposed. The company recommends downloading the latest firmware updates from its official support portal and applying them without delay. Additionally, administrators should enforce strong password policies and restrict access to management interfaces to trusted networks only. Organizations and individual users should treat CVE-2026-5509 as a serious security risk and prioritize remediation to prevent potential exploitation and network compromise. Free Webinar on OWASP API Top 10 and Guide to Close Visibility Gaps With WAAP Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Abinayahttps://cybersecuritynews.com/ Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space. Trending News Top 10 Best Static Application Security Testing (SAST) Tools for Security Teams in 2026 Google Chrome’s Device-Bound Session Credentials Now GA to Block Account Takeovers Top 10 Best Mobile Application Security Testing (MAST) Tools in 2026 India’s CERT-In Asks Organizations to Patch Vulnerabilities in Systems Within 12 hours Hackers Deploy AZUREVEIL Adaptix C2 Agent via Spearphishing Campaign Latest News Cyber Security News Hackers Deploy AZUREVEIL Adaptix C2 Agent via Spearphishing Campaign API Web App and API Attacks are Rising: Are You Blind to AI Web Attacks? Join Free WAAP Security Webinar  Cyber Security News PHANTOMPULSE RAT Uses Process Injection and UAC Bypass to Compromise Windows Systems Cyber Security News Nimbus Manticore APT Abuses Fake Recruitment Portal to Deliver Custom Malware Android Android 0-Day Vulnerability Exploited in Attacks to Gain Complete Device Control