Vulnerability intelligence

CVE-2026-16348

TP-Link Systems Inc. Archer BE800 v1 CWE-78

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.

CVSS Score

8.5

High

EPSS — Exploit Probability

2.0%

Riskier than 80% of all CVEs · checked 2026-10-08

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published