CVE-2026-5509: Arbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE7200

Synopsis

An authenticated command injection vulnerability affects the TP-Link Archer BE450 v1 and BE7200 v1 routers. The vulnerability is reachable over an adjacent network and requires a valid administrator account; an attacker uses the browser developer console to supply crafted input that reaches backend system commands without adequate sanitization. Successful exploitation gives the attacker arbitrary command execution with elevated privileges on the device, enabling full compromise of the router's operating environment. A patched-image rebuild at version 1.3.0 Build 20260416 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same local network segment, LAN, or VPN as the targeted device; remote internet-based exploitation is not possible with this vector.

• AuthenticationRequired

  A valid administrator account on the router's web management interface is required before the injection can be attempted.

• Victim interactionNot required

  No action by any other user or victim is needed once the attacker has authenticated to the admin interface.

• Attack complexityDetail

  Exploitation is reliable and condition-free once adjacency and credentials are satisfied, with no race conditions or special environmental factors required.

Blast Radius

• Attacker executes arbitrary system commands with elevated privileges on the router, gaining full control over the device's operating environment.
• Attacker can start unauthorized services or establish persistent backdoors on the device.
• Attacker can modify system configuration, including routing rules, DNS settings, and firewall policies, affecting all traffic passing through the router.
• All three impact dimensions (confidentiality, integrity, and availability) on the vulnerable component are fully compromised, meaning stored credentials, configuration data, and device availability are all at risk.