InfoSecBulletin Cybersecurity for mankind
TP-Link has revealed a serious security problem in its Archer BE450 and Archer BE7200 Wi-Fi routers. This flaw could let an attacker run commands from afar if they get admin access.
The flaw, called CVE-2026-5509, has a score of 8.5 (High) in CVSS v4.0, showing how dangerous it is for home and small-office networks that use these devices as main gateways.
CISA alerts on multiple PaperCut NG/MF flaws being actively exploited
Fire Ant hackers convert Cisco routers into spy platforms
Five Critical WordPress Flaws Lead to Site Takeover or RCE
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 AirportsÂ
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
TP-Link Router Security Flaw
The flaw is an issue that allows unauthorized commands in the web management part of the Archer BE450 v1 and BE7200 v1 routers.
The issue impacts firmware versions older than 1.3.0 Build 20260416 on both models. This means any device without this firmware update could be at risk of exploitation. TP-Link points out that these models are not sold in the U.S. But they can be found in other markets and may be used in sensitive places.
The attack starts when the threat actor logs into the router’s admin page with correct details. After logging in, they can use the browser’s developer tools to create and send input that the backend systems do not clean properly.
The application sends this input straight to system commands without proper checks, so the router runs random commands with high access, giving control of the embedded operating system.
An attacker with this access could start unapproved services, change routing and DNS settings, install more malware, or use the router to launch further attacks inside the local network.
Compromised routers can be added to botnets, used for spying on communications, or set up to send ongoing traffic to servers controlled by attackers.
The flaw needs high privileges (PR:H), but the danger grows when admins use the same passwords, depend on weak logins, or leave management interfaces open to less secure networks.
TP-Link has launched updated firmware for the affected models and asks users to upgrade to version 1.3.0 Build 20260416 or higher as soon as they can. Users can download the firmware images for Archer BE450 and Archer BE7200 from TP-Link’s support sites, including English and Japanese options.
The vendor suggests allowing only some people to use the web management interface, turning off remote administration when it’s not needed, and using strong, unique passwords for administrators to lower the chance of losing credentials.
CVE-2026-5509 is another command injection problem that affects router web interfaces. This highlights how important it is to handle input securely in web management code. For those protecting the system, quick updates, strict access rules, and constant checking of router actions are key to stopping network issues from gateway problems.
