CVE-2026-78541

High

Description

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report generation and may result in arbitrary command execution. Successful exploitation may allow command execution on the affected device with potential impact to device confidentiality, integrity, and availability.

SeverityHigh

CVSS8.5

Exploit probability—

ProductArcher BE3600 v1

PublishedAug 24, 2026

First seenAug 24, 2026

Weakness typeCWE-78OS command injection

How to fix

Update

TP-Link Systems Inc. Archer BE3600 v11.2.6 Build 20260617 or later

Patches

Vendor advisories

tp-link.com/us/support/faq/5264/

Affected products

Product	Affected versions	Fixed in
TP-Link Systems Inc. Archer BE3600 v1	v < 1.2.6 Build 20260617	1.2.6 Build 20260617

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.