TP-Link Archer BE800 CVE-2026-16348

Two concrete prerequisites must be satisfied: (1) the attacker must possess valid administrative (high-privilege) credentials for the Archer BE800 V1 management interface, confirmed by PR:H in the CVSS vector - low-privilege or unauthenticated users cannot trigger this flaw; and (2) the attacker must have adjacent network access (AV:A), meaning physical presence on the same local network segment, Wi-Fi association, or a directly adjacent link - remote internet-based exploitation is not possible without prior LAN compromise. Additionally, the VPN connection feature must be accessible within the admin session used. Limiting factors are the admin credential requirement (ruling out exploitation by guests, low-privilege LAN users, or internet-facing attackers) and the adjacent network constraint (ruling out WAN-side exploitation). No user interaction is required once prerequisites are met (UI:N), and no special attack timing or race condition is needed (AC:L, AT:N).

The CVSS 4.0 score of 8.5 with AV:A and PR:H correctly reflects two substantive barriers to exploitation: the attacker must hold valid administrative credentials and must operate from an adjacent network position - ruling out unauthenticated internet-scale exploitation. These constraints meaningfully reduce mass-exploitation risk compared to a network/unauthenticated vector. No EPSS score was provided in the intelligence, and the vulnerability is not listed in the CISA KEV catalog; no public POC has been identified at time of analysis, so exploitation probability beyond targeted, credential-holding adversaries cannot be quantified. Despite the access barriers, the technical impact is severe: VC:H/VI:H/VA:H on the primary system with additional low-level impact on adjacent LAN hosts. The realistic exploitation population is scenarios where admin credentials are reused, phished, or exposed - common in small business and home-office deployments where the Archer BE800 is likely to be found. Patching is the clear remediation and the patch (1.4.2 Build 260708) is confirmed available; any deployment still running an older firmware should treat this as a priority update given how completely root command injection defeats all router-level security controls.

An attacker who has acquired administrative credentials for the Archer BE800 V1 - through credential reuse, phishing, or compromise of a management workstation - accesses the router's management interface from an adjacent network position and submits a VPN connection configuration containing injected shell metacharacters. The router's VPN handler passes the unsanitized input to the system shell, executing attacker-supplied commands as root. The attacker then deploys a persistent reverse shell or modifies router firmware to maintain access, and proceeds to intercept traffic from or pivot attacks toward all devices on the connected LAN.