TP-Link Archer BE3600 CVE-2026-78541

Exploitation requires three specific, concurrent conditions: (1) the attacker must be on the adjacent network (LAN or WiFi segment of the router-not reachable from the internet without prior LAN access); (2) the attacker must be authenticated as an administrator of the router (PR:H); and (3) the parent-control module must be accessible and the cloud report generation feature must be active, as this is the specific processing path that unsafely handles the stored profile name. The payload does not execute immediately upon saving-it fires during the next daily cloud report generation cycle, introducing a time gap between planting and impact. Key limiting factors: administrative credentials are mandatory (not a default-credential or unauthenticated flaw); local network presence is required; and the cloud reporting scheduled task must run for the injection to trigger. Defenders who disable cloud reporting, enforce strong unique admin passwords, and isolate router management access to trusted hosts substantially reduce realistic exploitability.

The CVSS 4.0 score of 8.5 with vector AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L accurately reflects the real-world constraints. The adjacent-network requirement (AV:A) confines exploitability to attackers already present on the LAN or WiFi segment-not reachable from the internet directly-which substantially reduces the exposed attack surface relative to a purely network-accessible flaw. The high-privilege requirement (PR:H) further gates exploitation behind valid administrative credentials, meaning an opportunistic attacker must first compromise or possess admin access. Full confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H) correctly captures the potential for full device takeover. Secondary system impact is rated low (SC:L/SI:L/SA:L), reflecting that downstream network clients could be affected if the router's routing or DNS functions are subverted. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantitatively assessed. The vulnerability is not listed in CISA KEV, and no POC has been identified, indicating this is not yet being actively exploited at scale. Real-world priority is moderate: high for households or small offices where admin credentials are shared or weakly protected, lower for environments with strict admin access controls.

An attacker who has obtained administrative credentials to the TP-Link Archer BE3600 V1-through credential reuse, a weak default password, or compromise of another LAN device-logs into the router management interface from the local network and creates a parental-control profile with a name containing shell metacharacters and an embedded command payload. The malicious profile name is saved to device storage. When the router's daily cloud report generation routine executes overnight, the unsanitized profile name is interpolated into a shell command, executing the attacker's payload with device-level privileges and potentially establishing persistent backdoor access or exfiltrating device configuration. No public exploit code has been identified at time of analysis.