InfoSecBulletin Cybersecurity for mankind
TP-Link has revealed a serious security problem in its Archer BE450 and Archer BE7200 Wi-Fi routers. This flaw could let an attacker run commands from afar if they get admin access.
The flaw, called CVE-2026-5509, has a score of 8.5 (High) in CVSS v4.0, showing how dangerous it is for home and small-office networks that use these devices as main gateways.
LastPass says hackers stole customer data via Klue, supply chain breach
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
TP-Link Router Security Flaw
The flaw is an issue that allows unauthorized commands in the web management part of the Archer BE450 v1 and BE7200 v1 routers.
The issue impacts firmware versions older than 1.3.0 Build 20260416 on both models. This means any device without this firmware update could be at risk of exploitation. TP-Link points out that these models are not sold in the U.S. But they can be found in other markets and may be used in sensitive places.
The attack starts when the threat actor logs into the router’s admin page with correct details. After logging in, they can use the browser’s developer tools to create and send input that the backend systems do not clean properly.
The application sends this input straight to system commands without proper checks, so the router runs random commands with high access, giving control of the embedded operating system.
An attacker with this access could start unapproved services, change routing and DNS settings, install more malware, or use the router to launch further attacks inside the local network.
Compromised routers can be added to botnets, used for spying on communications, or set up to send ongoing traffic to servers controlled by attackers.
The flaw needs high privileges (PR:H), but the danger grows when admins use the same passwords, depend on weak logins, or leave management interfaces open to less secure networks.
TP-Link has launched updated firmware for the affected models and asks users to upgrade to version 1.3.0 Build 20260416 or higher as soon as they can. Users can download the firmware images for Archer BE450 and Archer BE7200 from TP-Link’s support sites, including English and Japanese options.
The vendor suggests allowing only some people to use the web management interface, turning off remote administration when it’s not needed, and using strong, unique passwords for administrators to lower the chance of losing credentials.
CVE-2026-5509 is another command injection problem that affects router web interfaces. This highlights how important it is to handle input securely in web management code. For those protecting the system, quick updates, strict access rules, and constant checking of router actions are key to stopping network issues from gateway problems.
