EUVD-2026-65007
GHSA-55gr-958w-9j4g
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent access and high-privilege authentication required (AV:A/PR:H); root command injection yields full C/I/A impact on the router with no scope change beyond the device.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection.
Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.
AnalysisAI
Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an authenticated administrator on an adjacent network to execute arbitrary OS commands with root privileges by injecting shell metacharacters through the VPN connection interface. Successful exploitation hands an attacker full control of the embedded Linux environment, enabling persistent backdoors, credential theft, and use of the router as a pivot into the connected LAN. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must be satisfied: (1) the attacker must possess valid administrative (high-privilege) credentials for the Archer BE800 V1 management interface, confirmed by PR:H in the CVSS vector - low-privilege or unauthenticated users cannot trigger this flaw; and (2) the attacker must have adjacent network access (AV:A), meaning physical presence on the same local network segment, Wi-Fi association, or a directly adjacent link - remote internet-based exploitation is not possible without prior LAN compromise. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 with AV:A and PR:H correctly reflects two substantive barriers to exploitation: the attacker must hold valid administrative credentials and must operate from an adjacent network position - ruling out unauthenticated internet-scale exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has acquired administrative credentials for the Archer BE800 V1 - through credential reuse, phishing, or compromise of a management workstation - accesses the router's management interface from an adjacent network position and submits a VPN connection configuration containing injected shell metacharacters. The router's VPN handler passes the unsanitized input to the system shell, executing attacker-supplied commands as root. … |
| Remediation | The primary fix is to update the Archer BE800 V1 firmware to version 1.4.2 Build 260708 or later, available directly from TP-Link at https://www.tp-link.com/us/support/download/archer-be800/v1/#Firmware, with additional guidance in the advisory at https://www.tp-link.com/us/support/faq/5264/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all TP-Link Archer BE800 V1 routers in your environment and identify those running firmware versions prior to 1.4.2 Build 260708; prioritize assessment of routers in security-critical network segments and those with external management access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Archer Be800 V1
View allSame weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today