InfoSecBulletin Cybersecurity for mankind
TP-Link has revealed a serious security problem in its Archer BE450 and Archer BE7200 Wi-Fi routers. This flaw could let an attacker run commands from afar if they get admin access.
The flaw, called CVE-2026-5509, has a score of 8.5 (High) in CVSS v4.0, showing how dangerous it is for home and small-office networks that use these devices as main gateways.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
TP-Link Router Security Flaw
The flaw is an issue that allows unauthorized commands in the web management part of the Archer BE450 v1 and BE7200 v1 routers.
The issue impacts firmware versions older than 1.3.0 Build 20260416 on both models. This means any device without this firmware update could be at risk of exploitation. TP-Link points out that these models are not sold in the U.S. But they can be found in other markets and may be used in sensitive places.
The attack starts when the threat actor logs into the router’s admin page with correct details. After logging in, they can use the browser’s developer tools to create and send input that the backend systems do not clean properly.
The application sends this input straight to system commands without proper checks, so the router runs random commands with high access, giving control of the embedded operating system.
An attacker with this access could start unapproved services, change routing and DNS settings, install more malware, or use the router to launch further attacks inside the local network.
Compromised routers can be added to botnets, used for spying on communications, or set up to send ongoing traffic to servers controlled by attackers.
The flaw needs high privileges (PR:H), but the danger grows when admins use the same passwords, depend on weak logins, or leave management interfaces open to less secure networks.
TP-Link has launched updated firmware for the affected models and asks users to upgrade to version 1.3.0 Build 20260416 or higher as soon as they can. Users can download the firmware images for Archer BE450 and Archer BE7200 from TP-Link’s support sites, including English and Japanese options.
The vendor suggests allowing only some people to use the web management interface, turning off remote administration when it’s not needed, and using strong, unique passwords for administrators to lower the chance of losing credentials.
CVE-2026-5509 is another command injection problem that affects router web interfaces. This highlights how important it is to handle input securely in web management code. For those protecting the system, quick updates, strict access rules, and constant checking of router actions are key to stopping network issues from gateway problems.
