InfoSecBulletin Cybersecurity for mankind
TP-Link has revealed a serious security problem in its Archer BE450 and Archer BE7200 Wi-Fi routers. This flaw could let an attacker run commands from afar if they get admin access.
The flaw, called CVE-2026-5509, has a score of 8.5 (High) in CVSS v4.0, showing how dangerous it is for home and small-office networks that use these devices as main gateways.
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
TP-Link Router Security Flaw
The flaw is an issue that allows unauthorized commands in the web management part of the Archer BE450 v1 and BE7200 v1 routers.
The issue impacts firmware versions older than 1.3.0 Build 20260416 on both models. This means any device without this firmware update could be at risk of exploitation. TP-Link points out that these models are not sold in the U.S. But they can be found in other markets and may be used in sensitive places.
The attack starts when the threat actor logs into the router’s admin page with correct details. After logging in, they can use the browser’s developer tools to create and send input that the backend systems do not clean properly.
The application sends this input straight to system commands without proper checks, so the router runs random commands with high access, giving control of the embedded operating system.
An attacker with this access could start unapproved services, change routing and DNS settings, install more malware, or use the router to launch further attacks inside the local network.
Compromised routers can be added to botnets, used for spying on communications, or set up to send ongoing traffic to servers controlled by attackers.
The flaw needs high privileges (PR:H), but the danger grows when admins use the same passwords, depend on weak logins, or leave management interfaces open to less secure networks.
TP-Link has launched updated firmware for the affected models and asks users to upgrade to version 1.3.0 Build 20260416 or higher as soon as they can. Users can download the firmware images for Archer BE450 and Archer BE7200 from TP-Link’s support sites, including English and Japanese options.
The vendor suggests allowing only some people to use the web management interface, turning off remote administration when it’s not needed, and using strong, unique passwords for administrators to lower the chance of losing credentials.
CVE-2026-5509 is another command injection problem that affects router web interfaces. This highlights how important it is to handle input securely in web management code. For those protecting the system, quick updates, strict access rules, and constant checking of router actions are key to stopping network issues from gateway problems.
