InfoSecBulletin Cybersecurity for mankind
TP-Link has revealed a serious security problem in its Archer BE450 and Archer BE7200 Wi-Fi routers. This flaw could let an attacker run commands from afar if they get admin access.
The flaw, called CVE-2026-5509, has a score of 8.5 (High) in CVSS v4.0, showing how dangerous it is for home and small-office networks that use these devices as main gateways.
NetamLoader malware to attack Win10: Customized for Gov.t in Asia
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
NIST Unveiled Guidance for Post-Quantum Cryptography Transition
Daily Cyber security update for 29.10. 2026
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
TP-Link Router Security Flaw
The flaw is an issue that allows unauthorized commands in the web management part of the Archer BE450 v1 and BE7200 v1 routers.
The issue impacts firmware versions older than 1.3.0 Build 20260416 on both models. This means any device without this firmware update could be at risk of exploitation. TP-Link points out that these models are not sold in the U.S. But they can be found in other markets and may be used in sensitive places.
The attack starts when the threat actor logs into the router’s admin page with correct details. After logging in, they can use the browser’s developer tools to create and send input that the backend systems do not clean properly.
The application sends this input straight to system commands without proper checks, so the router runs random commands with high access, giving control of the embedded operating system.
An attacker with this access could start unapproved services, change routing and DNS settings, install more malware, or use the router to launch further attacks inside the local network.
Compromised routers can be added to botnets, used for spying on communications, or set up to send ongoing traffic to servers controlled by attackers.
The flaw needs high privileges (PR:H), but the danger grows when admins use the same passwords, depend on weak logins, or leave management interfaces open to less secure networks.
TP-Link has launched updated firmware for the affected models and asks users to upgrade to version 1.3.0 Build 20260416 or higher as soon as they can. Users can download the firmware images for Archer BE450 and Archer BE7200 from TP-Link’s support sites, including English and Japanese options.
The vendor suggests allowing only some people to use the web management interface, turning off remote administration when it’s not needed, and using strong, unique passwords for administrators to lower the chance of losing credentials.
CVE-2026-5509 is another command injection problem that affects router web interfaces. This highlights how important it is to handle input securely in web management code. For those protecting the system, quick updates, strict access rules, and constant checking of router actions are key to stopping network issues from gateway problems.
