CVE-2026-16348

High

Description

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.

SeverityHigh

CVSS8.5

Exploit probability—

ProductArcher BE800 v1

PublishedAug 24, 2026

First seenAug 24, 2026

Weakness typeCWE-78OS command injection

How to fix

Update

TP-Link Systems Inc. Archer BE800 v11.4.2 Build 260708 or later

Patches

Vendor advisories

tp-link.com/us/support/faq/5264/

Affected products

Product	Affected versions	Fixed in
TP-Link Systems Inc. Archer BE800 v1	v < 1.4.2 Build 260708	1.4.2 Build 260708

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.